From a71fea0fdc776fcbb6a7876f384779a7bb57a5b5 Mon Sep 17 00:00:00 2001
From: MNIKIEMA <nikiemamahamadi01@gmail.com>
Date: Wed, 21 Oct 2026 12:36:22 +0200
Subject: [PATCH 1/2] chore(security): bump uv-pre-commit to 0.13.4

uv < 0.13.4 and certifi < 2026.10.19 ship the compromised emSign ECC Root CA - G3 root.
---
 .pre-commit-config.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index e52b65e..603a283 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
 - repo: https://github.com/astral-sh/uv-pre-commit
-  rev: 0.9.18
+  rev: 0.13.4
   hooks:
   - id: uv-lock
 

From 4656e4ed96011dfec5222b1974b13eaa1038ad1d Mon Sep 17 00:00:00 2001
From: MNIKIEMA <nikiemamahamadi01@gmail.com>
Date: Wed, 21 Oct 2026 12:50:03 +0200
Subject: [PATCH 2/2] docs(changelog): note emSign CA root fix

---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a4af7e8..319ab36 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,3 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## Unreleased
+
+### Security
+
+- Bumped the `uv-pre-commit` hook to uv 0.13.4. Earlier versions ship the compromised emSign ECC Root CA - G3 root, which certifi 2026.10.19 and uv 0.13.4 remove.