[ValentaTomas]

Moves certifi to 2026.10.19 in 14 example uv.lock files and 5 poetry.lock files, and the DSPy workflow's setup-uv pin 0.11.26 → 0.13.4 — the versions the eMudhra intermediate-CA disclosure lists as patched: https://emudhra.we-have-a-problem.com/. Every lock changes only certifi (the uv locks also move revision 3 → 5, the format uv 0.13 writes, and the claude-code-in-sandbox lock drops one redundant typing-extensions marker under exceptiongroup); poetry locks keep their content-hash and generator version. Two examples are deliberately left out: openai-computer-use-python, whose 7-day exclude-newer guard still excludes certifi 2026.10.19 (it clears on 2026-10-27, or with a certifi = false exception beside the openai one), and anthropic-managed-agents/python, whose lock is already out of date with its pyproject.toml, so uv re-resolves a dozen packages. Reviewers: check the lock diffs are certifi-only and the DSPy, TRL and OpenEnv workflows pass.

anthropic-managed-agents/python (second commit): its lock pinned e2b 2.21.1 although pyproject.toml requires e2b>=2.38.0,<3, so it no longer matched its own project. Re-locking it is the only way to move certifi there, and it also brings e2b to 2.59.0 with its new dependencies (connectrpc, pyqwest, protobuf-py, opentelemetry-api). uv lock --check passes. The example has no CI, so a quick uv sync && uv run anthropic-managed-agents-show-environment --help is worth running.

[cursor]

PR Summary

Medium Risk
Most edits are CA-bundle lockfile updates; the anthropic-managed-agents lock carries a major e2b stack change that could affect sandbox behavior in that example.

Overview
Bumps certifi to 2026.10.19 across many example uv.lock and poetry.lock files, and pins setup-uv 0.11.26 → 0.13.4 in the DSPy workflow. Regenerated uv.lock files also move revision from 3 to 5; anthropic-claude-code-in-sandbox drops a redundant typing-extensions marker on exceptiongroup.

examples/anthropic-managed-agents/python/uv.lock is not certifi-only: it refreshes e2b (2.21 → 2.59), updates the e2b specifier in lock metadata, and pulls in connectrpc/pyqwest/protobuf-py and related deps. That conflicts with the PR note that this example was left out on purpose.

^{Reviewed by Cursor Bugbot for commit eac8d48. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

I reviewed this PR and didn't find any bugs. It changes the pinned CA-bundle package and its hashes in 19 lockfiles, and I couldn't check those hashes against PyPI from here, so a human should confirm them before merging.

What was reviewed:

• Every certifi entry across the 14 uv.lock and 5 poetry.lock files has the same files.pythonhosted.org URLs and the same pair of sha256 hashes. I didn't confirm that those hashes match the files PyPI actually serves for 2026.10.19.
• revision = 5 is safe for --frozen/--locked. openai-computer-use-python/uv.lock was already at revision 5 on the base commit. The TRL and OpenEnv workflows don't pin a uv version, and DSPy now pins 0.13.4.
• The one lock edit that isn't certifi is in anthropic-claude-code-in-sandbox-python/uv.lock, where the python_full_version < '3.13' marker on exceptiongroup's typing-extensions dependency is gone. It does no harm because exceptiongroup only installs below 3.11. But it doesn't match exceptiongroup's own metadata, so it may have been edited by hand rather than re-resolved.
• The advisory link given as the reason for the bump points to an unofficial-looking domain. It's worth checking against an upstream certifi or Mozilla source.

Extended reasoning...

The change bumps certifi to 2026.10.19 in 19 example lockfiles, moves the uv locks from revision 3 to 5, and raises the DSPy workflow's setup-uv pin from 0.11.26 to 0.13.4. Its security-sensitive surface is supply chain: it swaps the trusted CA-bundle package and its hashes across every Python example. The new hashes are the same in every file, but PyPI couldn't be reached from this review to confirm they are genuine. The stated reason links to a non-official advisory domain, and one lock contains a dependency-marker edit that isn't certifi. Those two unverifiable points decided the deferral, even though the edits themselves are mechanical.

[ValentaTomas]

Re the hash check: I compared every certifi entry in the 20 changed lockfiles (15 uv.lock, including the re-locked anthropic-managed-agents one, plus 5 poetry.lock) against PyPI's JSON API for certifi 2026.10.19. Every lock pins 2026.10.19, and its sha256 values are exactly PyPI's for certifi-2026.10.19-py3-none-any.whl (42d35340cc5b…) and certifi-2026.10.19.tar.gz (035c1e85572b…).