[davidmreed]

What changes

• tutorial/PythOnBoardingBot/requirements.txt: certifi -> certifi>=2026.10.19.
• requirements/testing.txt: adds certifi>=2026.10.19 next to boto3<=2. This file is CI/test-only; botocore verifies TLS with certifi.

pyproject.toml runtime deps, the optional extra (requirements/optional.txt) and python_requires are unchanged.

Where it ships

• The published wheel (.github/workflows/pypi-release.yml:29,63) has no runtime deps (pyproject.toml:7) and uses stdlib ssl.create_default_context() (slack_sdk/socket_mode/builtin/internals.py:43), i.e. the OS trust store, so the library itself is not changed here.
• requirements/testing.txt is installed by CI (.github/workflows/ci-build.yml:86,151) and scripts/install.sh:10. boto3 is at requirements/testing.txt:41.
• The tutorial requirements are a user-facing template (tutorial/PythOnBoardingBot/requirements.txt:3).

Not covered by this PR

• The optional extra (boto3 in requirements/optional.txt:23) is a consumer range and is intentionally not touched. Consumers using boto3 should pick up certifi 2026.10.19 in their own environments.
• No lockfiles exist in this repo, so there is nothing to relock.

Verification

• pip install --dry-run --report of requirements/testing.txt and tutorial/PythOnBoardingBot/requirements.txt in python:3.7-slim and python:3.13-slim: both resolve certifi==2026.10.19 (certifi 2026.10.19 declares Requires-Python >=3.7, so the oldest CI matrix row still resolves).

🤖 Generated with Claude Code
Part of the eMudhra 53119 CA-distrust remediation (CVE-2026-111943).

[salesforce-cla]

Thanks for the contribution! Before we can merge this, we need @davidmreed to sign the Salesforce Inc. Contributor License Agreement.