From dc7a78a79ee314b791d3676444adbba547d25a86 Mon Sep 17 00:00:00 2001
From: Sayak Satpathi <170233065+sayaksatpathi@users.noreply.github.com>
Date: Fri, 16 Oct 2026 00:54:24 +0530
Subject: [PATCH] Relax the certifi lower bound and stop Dependabot raising
 lower bounds

Dependabot raised certifi from >=14.05.14 to >=2026.7.22, which makes
the client impossible to install next to an application that pins an
older certifi. The client only calls certifi.where(), which every
release provides.

Lower the bound to 2024.7.4, the oldest release without a known
advisory (CVE-2024-39689), and set versioning-strategy to widen for pip
so Dependabot keeps the ranges of this library open instead of raising
the lower bound on every new release.
---
 .github/dependabot.yml | 3 +++
 requirements.txt       | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f4e27ab10e..5461a64c60 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,6 +5,9 @@ updates:
     schedule:
       interval: "daily"
       time: "02:00"
+    # requirements.txt is the install_requires of a published library, so
+    # widen ranges instead of raising lower bounds on every new release.
+    versioning-strategy: "widen"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
diff --git a/requirements.txt b/requirements.txt
index 88921fee18..3af577ff92 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,4 +1,4 @@
-certifi>=2026.7.22 # MPL
+certifi>=2024.7.4 # MPL -- oldest release without a known advisory (CVE-2024-39689)
 python-dateutil>=2.8.2  # BSD
 pydantic>=2.14.1  # MIT
 setuptools>=84.0.0  # PSF/ZPL