[elithecho]

Why

An automated dependency audit of this repository's lock reported three advisories. Only the ones that are actually reachable or shipped are addressed here; the remainder is listed under "Not changed" with the reasoning.

1. certifi==2026.7.22 — GHSA-6q48-6c7w-9gw2 (runtime-relevant)

certifi before 2026.10.18 ships the emSign ECC Root CA - G3 root while eight eMudhra intermediate CA certificates chaining to it had their private keys compromised and were revoked. Anyone holding one of those intermediate keys can mint certificates that chain to a root still trusted by the bundle.

That matters for this SDK specifically because httpx builds its TLS context from certifi's bundle. A consumer running pip install proofline-sdk[dev] (or the lock in this repository) would trust that bundle, so an on-path attacker with one of the compromised keys could present a valid-looking certificate for the API host and read or rewrite review traffic. No attacker interaction with the SDK is required beyond being on path — the trust anchor is simply wrong. That is exactly the scenario the CA revocation was issued for.

Bumped to 2026.10.23, the first release after the bundle update.

2. pytest==8.4.2 — GHSA-6w46-j5rx-g56g (dev-only)

pytest ≤ 9.0.2 creates /tmp/pytest-of-{user} from a predictable name, which lets another local account pre-create it as a symlink and cause a denial of service or worse on shared CI hosts. Fixed in 9.0.3; bumped to 9.2.0.

3. pytest-asyncio (required by the above)

pytest-asyncio 1.2.0 pins pytest>=8.2,<9, so 9.2.0 needs pytest-asyncio >= 1.4. Bumped to 1.4.0 (pytest<10,>=8.4), which is the smallest version that widens the constraint.

Verification

• Every hash was taken from the PyPI release metadata for the exact new versions.
• python3 scripts/check.py passes end to end on this branch: generation check, HTTP contracts, ruff, mypy, pytest, wheel and sdist builds, and the install smoke test against both artifacts.

Not changed

Nothing else in the audit needed action. The remaining advisories it surfaced do not touch code this repository ships or runs.