fix(deps): move certifi to 2026.10.23 and grpcio to 1.84.1

codebase_rag/tests/test_build_tls_trust.py

@@ -19,10 +19,12 @@
 from __future__ import annotations
 
 import re
+import tomllib
 from pathlib import Path
 
 import pytest
 import yaml
+from packaging.requirements import Requirement
 from packaging.version import Version
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
@@ -264,6 +266,112 @@ def test_every_stage_that_installs_packages_upgrades_ca_certificates() -> None:
     } == {}
 
 
+# certifi's bundle and grpcio's roots.pem are their own copies of the roots:
+# certifi 2026.10.23 also drops emSign ECC Root CA - C3 and emSign Root CA -
+# C1, and grpcio 1.84.1 is the first whose roots.pem drops G3.
+LOCKFILE = REPO_ROOT / "uv.lock"
+LOCK_FLOORS = {"certifi": Version("2026.10.23"), "grpcio": Version("1.84.1")}
+GOOD_LOCK = (
+    '[[package]]\nname = "certifi"\nversion = "2026.10.23"\n\n'
+    '[[package]]\nname = "grpcio"\nversion = "1.84.1"\n'
+)
+_LOCKED = re.compile(
+    r'^\[\[package\]\]\nname = "(?P<name>[^"]+)"\nversion = "(?P<version>[^"]+)"',
+    re.MULTILINE,
+)
+
+
+def lock_problems(text: str) -> list[str]:
+    locked: dict[str, list[str]] = {}
+    for package in _LOCKED.finditer(text):
+        locked.setdefault(package["name"], []).append(package["version"])
+    return [
+        f"{name} {versions or 'unlocked'} below {floor}"
+        for name, floor in LOCK_FLOORS.items()
+        if not (versions := locked.get(name))
+        or any(fails_floor(v, floor) for v in versions)
+    ]
+
+
+@pytest.mark.parametrize(
+    "text",
+    [
+        GOOD_LOCK.replace("2026.10.23", "2026.10.19"),
+        GOOD_LOCK.replace("1.84.1", "1.84.0"),
+        GOOD_LOCK.split("\n\n")[1],
+    ],
+    ids=["old-certifi", "old-grpcio", "certifi-unlocked"],
+)
+def test_a_lock_with_a_stale_root_bundle_is_rejected(text: str) -> None:
+    assert text != GOOD_LOCK
+    assert lock_problems(text)
+
+
+def test_a_lock_at_the_floors_is_accepted() -> None:
+    assert lock_problems(GOOD_LOCK) == []
+
+
+def test_the_lock_is_past_every_bundled_root_fix() -> None:
+    assert lock_problems(LOCKFILE.read_text(encoding="utf-8")) == []
+
+
+# A published wheel carries pyproject's ranges, not uv.lock, and pip upgrades
+# a dependency only when the installed one no longer satisfies them. So the
+# floors are declared too: certifi in the core dependencies, grpcio in the
+# extras whose clients pull it in.
+PYPROJECT = REPO_ROOT / "pyproject.toml"
+LAST_STALE = {"certifi": "2026.10.19", "grpcio": "1.84.0"}
+GRPC_EXTRAS = ("semantic", "milvus")
+GOOD_PYPROJECT = (
+    '[project]\ndependencies = ["loguru>=0.7.3", "certifi>=2026.10.23"]\n'
+    "[project.optional-dependencies]\n"
+    'semantic = ["qdrant-client>=1.9.0", "grpcio>=1.84.1"]\n'
+    'milvus = ["pymilvus[milvus-lite]>=3.0.0", "grpcio>=1.84.1"]\n'
+)
+
+
+def declared_floor_problems(text: str) -> list[str]:
+    """Each place must require the package with a range that admits the
+    fixed release and refuses the last stale one."""
+    project = tomllib.loads(text)["project"]
+    extras = project.get("optional-dependencies", {})
+    places = [("certifi", "dependencies", project.get("dependencies", []))]
+    places += [("grpcio", f"extra {e}", extras.get(e, [])) for e in GRPC_EXTRAS]
+    problems = []
+    for name, where, requirements in places:
+        ranges = [r.specifier for r in map(Requirement, requirements) if r.name == name]
+        if not any(
+            s.contains(str(LOCK_FLOORS[name])) and not s.contains(LAST_STALE[name])
+            for s in ranges
+        ):
+            problems.append(f"{where} does not require {name}>={LOCK_FLOORS[name]}")
+    return problems
+
+
+@pytest.mark.parametrize(
+    "text",
+    [
+        GOOD_PYPROJECT.replace(', "certifi>=2026.10.23"', ""),
+        GOOD_PYPROJECT.replace("certifi>=2026.10.23", "certifi>=2026.10.19"),
+        GOOD_PYPROJECT.replace(', "grpcio>=1.84.1"]\n', "]\n", 1),
+        GOOD_PYPROJECT.replace("grpcio>=1.84.1", "grpcio>=1.84.0"),
+        GOOD_PYPROJECT.replace("certifi>=2026.10.23", "certifi"),
+    ],
+    ids=["no-certifi", "stale-certifi", "extra-without-grpcio", "stale-grpcio", "bare"],
+)
+def test_a_declared_range_that_admits_a_stale_bundle_is_rejected(text: str) -> None:
+    assert text != GOOD_PYPROJECT
+    assert declared_floor_problems(text)
+
+
+def test_declared_floors_are_accepted() -> None:
+    assert declared_floor_problems(GOOD_PYPROJECT) == []
+
+
+def test_pyproject_declares_every_bundled_root_floor() -> None:
+    assert declared_floor_problems(PYPROJECT.read_text(encoding="utf-8")) == []
+
+
 @pytest.mark.parametrize(
     "text",
     [

docs/getting-started/installation.md

@@ -311,6 +311,7 @@ This checks that all required dependencies and services are available.
 - **huggingface-hub**: Client library to download and publish models, datasets and other repos on the huggingface.co hub
 - **pathspec**: Utility library for gitignore style pattern matching of file paths.
 - **pygments**: Pygments is a syntax highlighting package written in Python.
+- **certifi**: Python package for providing Mozilla's CA Bundle.
 - **regex**: Alternative regular expression module, to replace re.
 - **cgr-graph-rs**: Native acceleration for code-graph-rag's embedded graph
 <!-- /SECTION:dependencies -->

pyproject.toml

@@ -60,6 +60,10 @@ dependencies = [
     "huggingface-hub[hf-xet]>=1.7.2",
     "pathspec>=1.0.4",
     "pygments>=2.20.0",
+    # certifi is the CA bundle httpx and requests verify against; 2026.10.23
+    # is the first without the distrusted eMudhra roots. Declared so an
+    # upgrade over an older install moves it too.
+    "certifi>=2026.10.23",
     # The embedded graph's `=~`: unlike `re`, a match takes a timeout, so a
     # backtracking pattern stops at the query's deadline. tiktoken already
     # installs it.
@@ -199,13 +203,18 @@ treesitter-full = [
 # qdrant-client is for CGR_VECTOR_STORE_BACKEND=qdrant, the default before it.
 semantic = [
     "qdrant-client>=1.9.0",
+    # The gRPC client verifies TLS against grpcio's own roots.pem; 1.84.1 is
+    # the first without emSign ECC Root CA - G3.
+    "grpcio>=1.84.1",
     "sqlite-vec>=0.1.9; (sys_platform == 'linux' and (platform_machine == 'x86_64' or platform_machine == 'aarch64')) or sys_platform == 'darwin' or (sys_platform == 'win32' and platform_machine == 'AMD64')",
     "torch>=2.6.0",
     "transformers>=5.0.0",
 ]
 
 milvus = [
     "pymilvus[milvus-lite]>=3.0.0",
+    # As in `semantic`: pymilvus's gRPC client trusts grpcio's roots.pem.
+    "grpcio>=1.84.1",
 ]
 
 # The default `sqlite` vector store alone, for an install that computes its