[dependabot]

Bumps certifi from 2026.7.22 to 2026.10.19.

Commits

• 662df63 Restore unaffected emSign roots (#439) (#440)
• 5cb238c Remove emsign (#437)
• 69494a7 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#436)
• 029c7b0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#435)
• 9d0a8f1 Add support for Python 3.15 (#432)
• db472ab Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#431)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	crowd-depth-api	c3d5fcc	Commit Preview URL Branch Preview URL	Oct 21 2026, 02:55 AM

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/crowd-depth@c3d5fcc

commit: c3d5fcc

[eddycoriolis]

Dependabot findings (MINOR)

certifi 2026.7.22 → 2026.10.19 in packages/grid/uv.lock. certifi isn't a direct dependency; it comes in through rasterio.

What changed

• Diff 2026.07.22...2026.10.19: removes the "emSign ECC Root CA - G3" root from the CA bundle (certifi#437; certifi#440 restored the other emSign roots) and adds the Python 3.15 classifier. No code changes.
• Dependabot's uv also raised the lockfile header from revision = 2 to revision = 3. The grid image uses uv 0.13.1 (Dockerfile#L17), and CI's uv run --locked accepts it.

Breaking changes that touch our code

• None found. Our grid code fetches over HTTPS with urllib.request (reference.py#L76), which uses the system trust store rather than certifi. The hosts it reads (noaa-*-pds.s3.amazonaws.com, api.tidesandcurrents.noaa.gov, openwaters.io) are AWS-, NOAA- and openwaters-hosted, none of which would plausibly chain to the removed emSign root. I checked with git grep for certifi, ssl and HTTP clients in packages/grid.

CI

• All checks pass, including Grid tests on Python 3.12 and 3.14. mergeStateStatus is CLEAN.

Overlaps

• None. This is the only PR touching uv.lock, and it doesn't conflict with Bump the npm group across 1 directory with 24 updates #177, Bump vite from 8.2.2 to 8.3.4 #175, Bump esbuild from 0.27.7 to 0.28.1 #174, Bump sharp and wrangler #124 or Bump undici and wrangler #118.

Before merging
Ready to merge.