fix(deps): drop the compromised emSign root from certifi and the system trust store

Dockerfile.django-alpine

@@ -57,6 +57,10 @@ RUN \
     && \
     rm -rf /var/cache/apk/* && \
   true
+# Upgrade the system trust store in its own layer. Release builds reuse the layer
+# above from the build cache, so an OS security fix to ca-certificates (here the
+# eMudhra key compromise, 2026-10-20) would otherwise never reach the image.
+RUN apk upgrade --no-cache ca-certificates-bundle ca-certificates
 RUN \
   --mount=from=build,src=/tmp/wheels,target=/tmp/wheels \
   --mount=from=build,src=/app/requirements.txt,target=/app/requirements.txt \

Dockerfile.django-debian

@@ -70,6 +70,15 @@ RUN \
   apt-get clean && \
   rm -rf /var/lib/apt/lists && \
   true
+# Upgrade the system trust store in its own layer. Release builds reuse the layer
+# above from the build cache, so an OS security fix to ca-certificates (here the
+# eMudhra key compromise, 2026-10-20) would otherwise never reach the image.
+RUN \
+  apt-get -y update && \
+  apt-get -y install --no-install-recommends --only-upgrade ca-certificates && \
+  apt-get clean && \
+  rm -rf /var/lib/apt/lists && \
+  true
 RUN \
   --mount=from=build,src=/tmp/wheels,target=/tmp/wheels \
   --mount=from=build,src=/app/requirements.txt,target=/app/requirements.txt \

requirements.txt

@@ -3,6 +3,7 @@ bleach==6.4.0
 bleach[css]
 celery[sqs]==5.6.3
 # pycurl and boto3 are included via celery[sqs] for Celery Broker AWS (SQS) support
+certifi==2026.10.19  # requests' CA bundle; 2026.10.19 drops emSign ECC Root CA - G3 (eMudhra intermediate key compromise)
 defusedxml==0.7.1
 django_celery_results==2.6.0
 django-auditlog==3.2.1