[kdmccormick]

Part of: openedx/public-engineering#574

Needs attention before merging: Certifi is the only version change, but the re-lock drops cryptography 50.0.0 wheels for macOS arm64, Windows and ppc64le (like openedx/taxonomy-connector#338). (asgiref and sqlparse are not removed; uv only added markers to django's dependencies on them.)

This was generated with uv lock --upgrade-package certifi (uv 0.13.4).

🤖 Generated with Claude Code

[kdmccormick]

🤖 This comment was generated by Claude (Claude Code), on behalf of @kdmccormick.

Pin changes in uv.lock: only certifi changes (2026.7.22 → 2026.10.19). No other package is added, removed or changes version. Most of the diff is uv rewriting dependency markers into simpler forms that mean the same thing. That rewrite comes from a newer uv, and it also bumps the lockfile revision from 3 to 5.

One concern: the lock drops 12 cryptography 50.0.0 wheels: all of its macOS arm64, Windows (win_amd64) and Linux ppc64le wheels. PyPI still serves them and none are yanked. Without those wheels, uv sync on an Apple Silicon Mac or on Windows would have to build cryptography from source, which needs a Rust toolchain.

• Re-locking with uv 0.13.4 (what generated this PR) drops the wheels every time, even with --refresh-package cryptography. uv 0.11.1 keeps them.
• It doesn't happen on every repo: openedx-platform's uv.lock kept its cryptography wheels under uv 0.13.4. So the cause isn't clear yet.
• build: upgrade certifi to 2026.10.19 taxonomy-connector#338 (already merged) shows the same drop.

Possible ways forward: re-lock with an older uv, wait for a uv fix or explanation, or accept that macOS and Windows will build from source.

(Correction to the PR description: asgiref and sqlparse are not removed. uv only added markers to django 5.2.17's dependencies on them, which doesn't change what gets installed.)