[mohamed-hashi-db]

Changes

certifi 2026.10.19 removes the distrusted eMudhra "emSign ECC Root CA - G3" root from its CA bundle, and pip 26.2.2 vendors that bundle. Earlier versions still trust certificates chained to that root.

• Add a runtime floor certifi>=2026.10.19 in pyproject.toml. certifi is not imported directly (it arrives via databricks-sdk -> requests), but the floor makes pip upgrade an older certifi that is already installed in the target environment.
• Raise pip~=26.0 to pip>=26.2.2,<27 (the existing "Temporary" comment is kept).
• Update uv.lock for certifi (2026.6.17 -> 2026.10.19) and pip (26.1.2 -> 26.2.2) only.

The floors reach installs with the next release.

Tests

• manually tested
• added unit tests
• added integration tests
• verified on staging environment (screenshot attached)

make test with uv 0.11.33. This environment cannot reach files.pythonhosted.org, so it ran on a copy of this branch whose uv.lock URLs point at an internal PyPI mirror:

$ make test
uv run --exact --all-extras pytest -n 4 --timeout 30 --durations 20 --cov src --cov-report=xml tests/unit
…
======================== 452 passed, 1 skipped in 5.90s ========================

CA bundles in that test environment:

$ .venv/bin/python -I -c 'import certifi, pip; print("certifi", certifi.__version__, "| pip", pip.__version__)'
certifi 2026.10.19 | pip 26.2.2
$ .venv/bin/python -I -c 'from pip._vendor import certifi as c; print("pip vendored certifi", c.__version__); print("emSign ECC Root CA - G3 in pip bundle:", "emSign ECC Root CA - G3" in open(c.where()).read())'
pip vendored certifi 2026.10.19
emSign ECC Root CA - G3 in pip bundle: False
$ .venv/bin/python -I -c 'import certifi; print("emSign ECC Root CA - G3 in certifi bundle:", "emSign ECC Root CA - G3" in open(certifi.where()).read())'
emSign ECC Root CA - G3 in certifi bundle: False

Old vs. new wheels (searching each wheel's cacert.pem for the root's name):

Wheel	emSign ECC Root CA - G3
certifi 2026.6.17 (old lock)	present
certifi 2026.10.19	absent
pip 26.1.2 (old lock), pip/_vendor/certifi/cacert.pem	present
pip 26.2.2, pip/_vendor/certifi/cacert.pem	absent

The lock was produced with uv lock --upgrade-package certifi --upgrade-package pip (uv 0.11.33), then the lock-dependencies URL scrub. The , size = N fields were also stripped to match the committed lock. uv lock --check exits 1 in this environment on both main and this branch (error: The lockfile at uv.lock needs to be updated, but --check was provided.), because the lock records pypi.org URLs and resolution here goes through the mirror. So I have not verified it here; CI will.

This pull request and its description were written by Isaac.

[github-actions]

✅ 37/37 passed, 4 skipped, 13m43s total

_{Running from acceptance #622}