[gantoine]

💡 Motivation and Context

Eight eMudhra intermediate CA private keys were broken, so anyone holding them can impersonate TLS servers to clients that still trust emSign ECC Root CA - G3. uv 0.13.4 and certifi 2026.10.19 are the first releases whose bundled CA store drops that root, and the versions pinned here still trust it. See the Python.org notice.''``

• .github/actions/setup-python-dev/action.yml, .github/workflows/ci.yml, .github/workflows/release.yml: setup-uv version 0.11.32 → 0.13.4
• .github/workflows/posthog-upgrade.yml: setup-uv version 0.12.21 → 0.13.4
• 38 lockfiles (root uv.lock, the examples/* projects, integration_tests/django5, playgrounds/fastapi-async-client) refreshed with uv lock --upgrade-package certifi: certifi → 2026.10.19 in all 38, and uv 0.11.15 → 0.13.4 in examples/example-ai-crewai (which depends on uv)
• The matching uv.toml / pyproject.toml files give certifi (and uv in the crewai example) a 1-day cooldown in exclude-newer-package. certifi 2026.10.19 is younger than the 7-day exclude-newer cooldown, so without this uv keeps resolving 2026.7.22, which still trusts the bad root. The 7-day rule still covers every other package.
• Side effect: the example locks also pick up the current local posthog version, which they had not been re-locked against.
• uv 0.13.4 also rewrites each lockfile's revision header.
• Not changed: playgrounds/fastapi-exception-capture/uv.lock stays on certifi 2025.6.15. It no longer resolves, because its requires-python = ">=3.9" admits Python 3.9 while the local posthog now needs 3.10. Fixing that is a separate change.

This touches CI, examples, playgrounds and the dev lockfile only. The published package and its dependency ranges are unchanged, so no changeset is needed.

💚 How did you test it?

• Lockfiles were regenerated with uv 0.13.4, and only the packages listed above changed.
• Re-scanned the repo after the change: no uv, pip or certifi version below the fix remains outside the playground noted above.
• Not run locally: CI and the test suite. This PR's checks cover them.

📝 Checklist

• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

If releasing new changes

• Ran sampo add to generate a changeset file (not needed: no released code changes)

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Claude Code, from an org-wide audit of certifi, pip, uv, sigstore and pixi versions after the eMudhra incident. Lockfiles were regenerated with uv 0.13.4, never edited by hand. A per-package cooldown was chosen over a fixed cutoff date so certifi keeps receiving updates.

---

Generated by Claude Code

[github-actions]

posthog-python Compliance Report

Date: 2026-10-22T14:06:53.492891+00:00
Duration: 259213ms

✅ All Tests Passed!

121/121 tests passed

---

Capture_V1 Tests

✅ 95/95 tests passed

View Details

Test	Status	Duration
Endpoint And Method.Targets V1 Endpoint	✅	513ms
Endpoint And Method.Does Not Use Legacy Endpoints	✅	508ms
Required Headers.Has Authorization Bearer Header	✅	508ms
Required Headers.Has Content Type Json	✅	509ms
Required Headers.Has Posthog Sdk Info Format	✅	508ms
Required Headers.Has Posthog Attempt Header	✅	508ms
Required Headers.Has Posthog Request Id	✅	508ms
Required Headers.Has Posthog Request Timestamp	✅	508ms
Required Headers.Has User Agent	✅	507ms
Body Format.Body Has Created At And Batch	✅	509ms
Body Format.No Api Key In Body	✅	507ms
Body Format.No Sent At In Body	✅	508ms
Event Format.Event Has Required Root Fields	✅	508ms
Event Format.Event Uuid Is Valid	✅	508ms
Event Format.Event Timestamp Is Rfc3339	✅	508ms
Event Format.Non Utc Event Timestamp Is Converted To Utc	✅	517ms
Event Format.Distinct Id Is String	✅	508ms
Event Format.Distinct Id At Root Not Properties	✅	508ms
Event Format.Custom Properties Preserved	✅	508ms
Event Format.Set Properties Preserved	✅	508ms
Event Format.Set Once Properties Preserved	✅	507ms
Event Format.Groups Properties Preserved	✅	508ms
Event Format.Sdk Generates Uuid If Not Provided	✅	508ms
Event Format.Event Has Required Root Fields Batch	✅	510ms
Event Format.Event Uuid Is Valid Batch	✅	511ms
Event Format.Event Timestamp Is Rfc3339 Batch	✅	510ms
Event Format.Distinct Id Is String Batch	✅	510ms
Event Format.Distinct Id At Root Not Properties Batch	✅	510ms
Event Format.Custom Properties Preserved Batch	✅	510ms
Event Format.Set Properties Preserved Batch	✅	510ms
Event Format.Set Once Properties Preserved Batch	✅	510ms
Event Format.Groups Properties Preserved Batch	✅	510ms
Event Format.Sdk Generates Uuid If Not Provided Batch	✅	510ms
Batch Behavior.Multiple Events In Single Batch	✅	513ms
Batch Behavior.Batch Envelope Smoke	✅	511ms
Batch Behavior.Flush With No Events Sends Nothing	✅	505ms
Batch Behavior.Flush At Triggers Batch	✅	1008ms
Batch Behavior.Created At Reflects Batch Creation Time	✅	508ms
Deduplication.Generates Unique Uuids	✅	513ms
Deduplication.Different Events Same Content Different Uuids	✅	509ms
Deduplication.Preserves Uuid On Retry	✅	6516ms
Deduplication.Preserves Timestamp On Retry	✅	6517ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	6519ms
Deduplication.No Duplicate Events In Batch	✅	514ms
Header Behavior On Retry.Attempt Header Starts At One	✅	508ms
Header Behavior On Retry.Attempt Header Increments On Retry	✅	13521ms
Header Behavior On Retry.Request Id Preserved On Retry	✅	6516ms
Header Behavior On Retry.Different Requests Have Different Request Ids	✅	3017ms
Header Behavior On Retry.Request Timestamp Changes On Retry	✅	6512ms
Response Format Validation.Success Response Has Uuid Keyed Results	✅	509ms
Response Format Validation.Success Response Has Ok For Each Event	✅	511ms
Response Format Validation.Success No Retry After When All Ok	✅	509ms
Response Format Validation.Success Retry After Present When Retry Events	✅	1513ms
Response Format Validation.Success No Retry After When Drop Only	✅	510ms
Response Format Validation.Response Echoes Request Id	✅	507ms
Retry Behavior.Retries On 408	✅	6516ms
Retry Behavior.Retries On 500	✅	6516ms
Retry Behavior.Retries On 503	✅	8520ms
Retry Behavior.Retries On 504	✅	6517ms
Retry Behavior.Retryable Errors Have Retry After	✅	3514ms
Retry Behavior.Respects Retry After On Retryable Error	✅	11520ms
Retry Behavior.Does Not Retry On 400	✅	2511ms
Retry Behavior.Does Not Retry On 401	✅	2510ms
Retry Behavior.Does Not Retry On 402	✅	2511ms
Retry Behavior.Does Not Retry On 413	✅	2509ms
Retry Behavior.Does Not Retry On 415	✅	2509ms
Retry Behavior.Non Retryable Errors Have No Retry After	✅	2511ms
Retry Behavior.Implements Backoff	✅	22532ms
Retry Behavior.Max Retries Respected	✅	22531ms
Partial Batch Handling.Handles 200 Full Success	✅	2511ms
Partial Batch Handling.Handles 200 With All Ok	✅	3513ms
Partial Batch Handling.Does Not Retry Dropped Events	✅	3525ms
Partial Batch Handling.Does Not Retry Limited Events	✅	3512ms
Partial Batch Handling.Prunes Ok Events On Partial Retry	✅	6515ms
Partial Batch Handling.Prunes Dropped Events On Partial Retry	✅	6515ms
Partial Batch Handling.Retries Only Retry Events From Partial	✅	6517ms
Partial Batch Handling.Partial Retry Preserves Uuids	✅	6515ms
Partial Batch Handling.Partial Retry Attempt Header Increments	✅	6517ms
Partial Batch Handling.Partial Retry Request Id Preserved	✅	6516ms
Partial Batch Handling.Respects Retry After On Partial	✅	8516ms
Partial Batch Handling.Unknown Result Treated As Terminal	✅	3513ms
Partial Batch Handling.Mixed Ok Drop Limited No Retry	✅	3515ms
Compression.Sends Gzip Content Encoding	✅	509ms
Compression.No Content Encoding When Disabled	✅	507ms
Compression.Compressed Body Is Decompressible	✅	508ms
Error Handling.Does Not Retry On Unknown 4Xx	✅	2511ms
Event Options.Cookieless Mode Override	✅	508ms
Event Options.Disable Skew Correction Override	✅	507ms
Event Options.Process Person Profile Override	✅	508ms
Event Options.Product Tour Id Override	✅	507ms
Event Options.Unset Options Omitted	✅	508ms
Event Options.Options Override In Batch	✅	509ms
Geoip And Historical Migration.Geoip Disable Injected Into Properties	✅	508ms
Geoip And Historical Migration.Historical Migration Set In Body	✅	507ms
Geoip And Historical Migration.Historical Migration Absent By Default	✅	507ms

Capture_Ai Tests

✅ 5/5 tests passed

View Details

Test	Status	Duration
Routing.Capture Ai Posts To Ai Endpoint	✅	509ms
Routing.Capture Does Not Reroute Ai Named Events	✅	507ms
Identity.Capture Ai Event Has Uuid	✅	508ms
Identity.Capture Ai Keeps Supplied Uuid	✅	507ms
Timestamp Format.Non Utc Event Timestamp Is Converted To Utc	✅	508ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	8ms
Request Payload.Flags Request Uses V2 Query Param	✅	6ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	6ms
Request Payload.Flags Request Omits Authorization Header	✅	5ms
Request Payload.Token In Flags Body Matches Init	✅	6ms
Request Payload.Groups Round Trip	✅	6ms
Request Payload.Groups Default To Empty Object	✅	6ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	6ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	6ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	6ms
Request Lifecycle.No Flags Request On Init Alone	✅	2ms
Request Lifecycle.No Flags Request On Normal Capture	✅	506ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	10ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	6ms
Retry Behavior.Retries Flags On 502	✅	310ms
Retry Behavior.Retries Flags On 504	✅	309ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	508ms

Feature_Flags_Local_Evaluation Tests

✅ 4/4 tests passed

View Details

Test	Status	Duration
Versioned Boolean Matching.Matching Version Missing	✅	44ms
Versioned Boolean Matching.Matching Version 1	✅	40ms
Versioned Boolean Matching.Matching Version 2	✅	41ms
Versioned Boolean Matching.Version Only Reload 1 2 1 2 Missing	✅	21ms