Security release. Dependency bumps for advisories published this week; no application code changed.
Certificate trust. certifi 2026.10.19 and uv 0.13.4 drop the emSign ECC Root CA - G3, whose intermediate CA keys were compromised (GHSA-6q48-6c7w-9gw2, GHSA-hq85-5cpj-mr62). The rebuilt image also carries Debian's patched ca-certificates (DSA-6572-1).
Other advisories. aiohttp 3.14.4, pydantic-ai-slim 2.53.0, virtualenv 21.14.9 and opentelemetry-api 1.45.1 move to their first patched releases. The edge worker's build and test tooling (vite, vitest, sharp, undici) is patched as well; the worker code itself is unchanged.