[Security] Refresh Python and runtime CA certificates (#62868)

Signed-off-by: Juan Pérez de Algaba <jperezde@redhat.com>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Cyrus Leung <tlleungac@connect.ust.hk>

docker/Dockerfile

@@ -760,6 +760,7 @@ RUN PYTHON_VERSION_STR=$(echo ${PYTHON_VERSION} | sed 's/\.//g') && \
 # Install Python and system dependencies
 RUN apt-get update -y \
     && apt-get install -y --no-install-recommends \
+        ca-certificates \
         software-properties-common \
         curl \
         sudo \

docs/contributing/dockerfile/dockerfile.md

@@ -20,6 +20,11 @@ The edges of the build graph represent:
 The `test-deps` stage branches from `vllm-runtime-base` so Git and the test
 requirements remain cached independently of per-commit vLLM wheels and source.
 
+The `vllm-runtime-base` stage explicitly installs the current Ubuntu
+`ca-certificates` package so clients using the system trust store receive
+certificate removals when the image is rebuilt. This complements the Python
+`certifi` bundle used by other HTTP clients.
+
 The `extensions-build` stage can also produce an optional source-built Triton
 wheel. `vllm-openai-base` installs that wheel after its other Python
 dependencies so dependency resolution cannot restore an older Triton version.

pyproject.toml

@@ -228,6 +228,7 @@ view_seperator = "view_seperator"
 inverse_std_variences = "inverse_std_variences"
 
 [tool.typos.default.extend-words]
+certifi = "certifi"
 MoNE = "MoNE"
 mone = "mone"
 Hel = "Hel"

requirements/common.txt

@@ -4,6 +4,7 @@ psutil
 sentencepiece  # Required for LLaMA tokenizer.
 numpy
 requests >= 2.33.0
+certifi >= 2026.10.19
 tqdm
 blake3
 py-cpuinfo

requirements/docs.in

@@ -1,4 +1,5 @@
 mkdocs<2.0.0
+certifi>=2026.10.19
 mkdocs-api-autonav
 mkdocs-material
 mkdocstrings-python

requirements/docs.txt

@@ -10,8 +10,10 @@ backrefs==8.0
     # via mkdocs-material
 bracex==3.0.1
     # via wcmatch
-certifi==2026.7.22
+certifi==2026.10.19
-    # via requests
+    # via
+    #   -r requirements/docs.in
+    #   requests
 charset-normalizer==3.5.1
     # via requests
 click==8.5.0

requirements/test/cpu.txt

@@ -102,8 +102,9 @@ cachetools==5.5.2
     #   google-auth
 cbor2==6.1.2
     # via -r requirements/test/../common.txt
-certifi==2024.8.30
+certifi==2026.10.19
     # via
+    #   -r requirements/test/../common.txt
     #   httpcore
     #   httpx
     #   requests

requirements/test/cuda.txt

@@ -107,8 +107,10 @@ cachetools==5.5.2
     #   google-auth
 cbor2==6.1.2
     # via -r requirements/test/../common.txt
-certifi==2024.8.30
+certifi==2026.10.19
     # via
+    #   -c requirements/common.txt
+    #   -r requirements/test/../common.txt
     #   httpcore
     #   httpx
     #   requests

requirements/test/rocm.txt

@@ -104,8 +104,10 @@ cachetools==7.0.5
     # via -r requirements/test/../common.txt
 cbor2==5.9.0
     # via -r requirements/test/../common.txt
-certifi==2026.2.25
+certifi==2026.10.19
     # via
+    #   -c requirements/common.txt
+    #   -r requirements/test/../common.txt
     #   httpcore
     #   httpx
     #   requests

requirements/test/xpu.txt

@@ -89,8 +89,10 @@ cachetools==7.1.7
     # via -r requirements/test/../common.txt
 cbor2==6.1.4
     # via -r requirements/test/../common.txt
-certifi==2026.7.22
+certifi==2026.10.19
     # via
+    #   -c requirements/common.txt
+    #   -r requirements/test/../common.txt
     #   httpcore
     #   httpx
     #   requests