This fixes a critical security alert (GHSA-6q48-6c7w-9gw2) in the helper
script that ranks top GitHub issues. The script now installs a safe
version of `certifi`.
## What changed
One entry in `script/update_top_ranking_issues/uv.lock` changed.
`certifi` moves from `2024.8.30` to `2026.10.19`. No other package
changed.
## Why it matters
`certifi` is the list of security certificates that Python trusts when
it connects to websites. Versions before `2026.10.18` still trust the
"emSign ECC Root CA - G3" certificate. Eight certificates issued under
it had their private keys stolen, and the issuer has revoked them. A
program that uses the old list can trust a fake website.
Nothing in this script asks for `certifi` directly. The `requests`
package (used to call the GitHub API) needs it. So only the lock file
changed, and `pyproject.toml` did not.
This script is a maintenance tool. It is not part of the Zed app, so Zed
users are not affected.
## Checks
- `uv lock --upgrade-package certifi` on `main`: changed only `certifi`.
- `uv run --frozen python -c "import certifi, requests"`: loads `certifi
2026.10.19` with `requests 2.34.2`.
- `uv run --frozen python main.py --help`: runs.
- Not run: the full script. It needs a GitHub token and makes real
changes to GitHub issues.
Release Notes:
- N/A
morgankrey
92447a17cc