Security patch: upgrade certifi to 2026.10.19 and require that minimum for new installations. This removes trust in the compromised emSign ECC Root CA - G3 while retaining unaffected emSign roots.
Addresses GHSA-6q48-6c7w-9gw2 and Dependabot alert 55. Existing security dependency minimums remain unchanged.
Upgrade existing installations, for example with uv tool upgrade mcp-proxy, or rebuild containers against this release. Custom trust bundles remain caller-controlled.
Changes: #283