SRE-1216: Update TLS trust dependencies

[indietyp]

🌟 Purpose

Update the Rust and Python TLS dependencies and the CA certificates bundled with uv. Keep the development-tool and container versions of uv aligned.

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[cursor]

PR Summary

Low Risk
Routine dependency and lockfile updates for TLS CA bundles and uv; no application logic changes, though refreshed root stores could surface TLS behavior differences in edge cases.

Overview
Bumps uv from 0.11.18 to 0.13.4 in mise (config.toml + mise.lock) and in apps/petrinaut-opt/docker/Dockerfile, so local dev and the petrinaut-opt image use the same uv release. The mise lock also refreshes per-platform download URLs/checksums for uv (Linux artifacts move from musl to gnu builds).

Refreshes Rust TLS trust stack in Cargo.lock: webpki-roots / webpki-root-certs 1.0.8 → 1.0.10 and rustls-webpki 0.103.15 → 0.103.16, affecting dependents such as hyper-rustls, reqwest, and ureq.

Regenerates apps/petrinaut-opt/uv.lock under the newer uv (revision 3 → 5), notably certifi 2026.6.17 → 2026.10.19 and a small exceptiongroup dependency marker change for typing-extensions.

^{Reviewed by Cursor Bugbot for commit 0ebc93e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hash	Ready	Preview	Oct 20, 2026 5:51pm UTC
hashdotdesign-tokens	Ready	Preview	Oct 20, 2026 5:51pm UTC
petrinaut	Ready	Preview	Oct 20, 2026 5:51pm UTC
petrinaut-docs	Ready	Preview	Oct 20, 2026 5:51pm UTC

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.03%. Comparing base (8b1cbc2) to head (0ebc93e).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #10124   +/-   ##
=======================================
  Coverage   68.03%   68.03%           
=======================================
  Files        2006     2006           
  Lines      206233   206288   +55     
  Branches     8796     8817   +21     
=======================================
+ Hits       140312   140355   +43     
- Misses      64253    64257    +4     
- Partials     1668     1676    +8     

Flag	Coverage Δ
apps.hash-ai-worker-ts	7.47% <ø> (+0.61%)	⬆️
apps.hash-api	15.59% <ø> (ø)
blockprotocol.type-system	40.85% <ø> (ø)
durable-kernel	86.62% <ø> (-0.12%)	⬇️
error-stack	90.55% <ø> (ø)
harpc-codec	84.61% <ø> (ø)
harpc-net	96.28% <ø> (+0.01%)	⬆️
harpc-tower	67.11% <ø> (ø)
harpc-types	0.00% <ø> (ø)
harpc-wire-protocol	93.85% <ø> (ø)
hash-codec	72.09% <ø> (ø)
hash-config	83.57% <ø> (ø)
hash-graph	21.07% <ø> (ø)
hash-graph-api	39.82% <ø> (ø)
hash-graph-atlas	80.01% <ø> (-0.01%)	⬇️
hash-graph-authentication	96.71% <ø> (ø)
hash-graph-authorization	68.47% <ø> (ø)
hash-graph-embeddings	91.92% <ø> (ø)
hash-graph-postgres-store	31.60% <ø> (ø)
hash-graph-store	50.82% <ø> (ø)
hash-graph-temporal-versioning	50.53% <ø> (ø)
hash-graph-types	0.00% <ø> (ø)
hash-graph-validation	85.37% <ø> (ø)
hash-integrations-definition	95.05% <ø> (ø)
hash-middleware	87.62% <ø> (ø)
hash-secret	99.50% <ø> (ø)
hashql-ast	90.01% <ø> (ø)
hashql-compiletest	28.71% <ø> (ø)
hashql-core	81.41% <ø> (ø)
hashql-diagnostics	72.85% <ø> (ø)
hashql-eval	81.55% <ø> (ø)
hashql-hir	89.10% <ø> (ø)
hashql-mir	87.22% <ø> (ø)
hashql-syntax-jexpr	94.77% <ø> (ø)
local.harpc-client	51.49% <ø> (ø)
local.hash-backend-utils	6.21% <ø> (ø)
local.hash-graph-sdk	9.79% <ø> (ø)
local.hash-isomorphic-utils	32.20% <ø> (+0.19%)	⬆️
problematic	90.09% <ø> (ø)
railroad-plugin	45.28% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codspeed]

Merging this PR will not alter performance

⚠️ 6 benchmarks measured no execution time

Nothing ran under measurement, usually because the compiler removed the code under test. These results are not comparable, so they count as unchanged.

Preventing compiler optimizations

• as_constant
• constant_equal
• constant_not_equal
• access
• runtime_equal
• runtime_not_equal

✅ 98 untouched benchmarks

---

_{Comparing bm/upgrade-ca (0ebc93e) with main (8b1cbc2)¹}

Footnotes

1. No successful run was found on main (5de2161) during the generation of this report, so 8b1cbc2 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[github-actions]

Benchmark results

hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$26.4 \mathrm{ms} \pm 221 \mathrm{μs}\left({\color{gray}1.72 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.55 \mathrm{ms} \pm 29.2 \mathrm{μs}\left({\color{gray}3.09 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$13.0 \mathrm{ms} \pm 141 \mathrm{μs}\left({\color{red}5.47 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$45.1 \mathrm{ms} \pm 471 \mathrm{μs}\left({\color{gray}4.82 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$16.0 \mathrm{ms} \pm 144 \mathrm{μs}\left({\color{red}10.1 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$26.4 \mathrm{ms} \pm 418 \mathrm{μs}\left({\color{red}9.55 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$27.7 \mathrm{ms} \pm 243 \mathrm{μs}\left({\color{gray}3.00 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.78 \mathrm{ms} \pm 23.5 \mathrm{μs}\left({\color{gray}-3.093 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$14.0 \mathrm{ms} \pm 145 \mathrm{μs}\left({\color{gray}3.44 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.94 \mathrm{ms} \pm 39.4 \mathrm{μs}\left({\color{gray}4.54 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.15 \mathrm{ms} \pm 20.4 \mathrm{μs}\left({\color{gray}3.44 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$3.54 \mathrm{ms} \pm 27.0 \mathrm{μs}\left({\color{gray}4.28 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.52 \mathrm{ms} \pm 48.7 \mathrm{μs}\left({\color{red}6.59 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.86 \mathrm{ms} \pm 38.4 \mathrm{μs}\left({\color{red}7.72 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$4.48 \mathrm{ms} \pm 33.6 \mathrm{μs}\left({\color{red}7.31 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.64 \mathrm{ms} \pm 36.4 \mathrm{μs}\left({\color{gray}2.39 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.56 \mathrm{ms} \pm 27.6 \mathrm{μs}\left({\color{gray}1.11 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.27 \mathrm{ms} \pm 36.2 \mathrm{μs}\left({\color{gray}1.16 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.97 \mathrm{ms} \pm 74.5 \mathrm{μs}\left({\color{red}7.54 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.79 \mathrm{ms} \pm 24.2 \mathrm{μs}\left({\color{gray}2.00 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.91 \mathrm{ms} \pm 23.6 \mathrm{μs}\left({\color{gray}2.66 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$3.14 \mathrm{ms} \pm 19.6 \mathrm{μs}\left({\color{gray}2.54 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.97 \mathrm{ms} \pm 22.0 \mathrm{μs}\left({\color{gray}1.95 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$3.27 \mathrm{ms} \pm 23.2 \mathrm{μs}\left({\color{gray}2.01 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.10 \mathrm{ms} \pm 22.1 \mathrm{μs}\left({\color{gray}0.062 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.81 \mathrm{ms} \pm 18.6 \mathrm{μs}\left({\color{gray}0.412 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$3.03 \mathrm{ms} \pm 22.6 \mathrm{μs}\left({\color{gray}3.15 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.56 \mathrm{ms} \pm 24.8 \mathrm{μs}\left({\color{gray}0.882 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.12 \mathrm{ms} \pm 25.4 \mathrm{μs}\left({\color{gray}1.55 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$3.35 \mathrm{ms} \pm 20.5 \mathrm{μs}\left({\color{gray}0.524 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.50 \mathrm{ms} \pm 24.6 \mathrm{μs}\left({\color{gray}1.63 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.13 \mathrm{ms} \pm 26.1 \mathrm{μs}\left({\color{gray}0.519 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.45 \mathrm{ms} \pm 25.7 \mathrm{μs}\left({\color{gray}2.89 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$33.8 \mathrm{ms} \pm 249 \mathrm{μs}\left({\color{red}6.46 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$74.0 \mathrm{ms} \pm 1.00 \mathrm{ms}\left({\color{red}6.73 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$37.9 \mathrm{ms} \pm 248 \mathrm{μs}\left({\color{red}7.10 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$39.4 \mathrm{ms} \pm 284 \mathrm{μs}\left({\color{gray}4.56 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$47.2 \mathrm{ms} \pm 358 \mathrm{μs}\left({\color{red}12.4 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$35.0 \mathrm{ms} \pm 267 \mathrm{μs}\left({\color{red}5.09 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$406 \mathrm{ms} \pm 1.59 \mathrm{ms}\left({\color{gray}-1.876 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$90.2 \mathrm{ms} \pm 612 \mathrm{μs}\left({\color{red}6.38 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$74.0 \mathrm{ms} \pm 582 \mathrm{μs}\left({\color{gray}0.597 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$278 \mathrm{ms} \pm 1.54 \mathrm{ms}\left({\color{gray}3.38 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$10.5 \mathrm{ms} \pm 71.8 \mathrm{μs}\left({\color{gray}-0.154 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$10.7 \mathrm{ms} \pm 74.7 \mathrm{μs}\left({\color{gray}2.87 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$10.9 \mathrm{ms} \pm 98.6 \mathrm{μs}\left({\color{gray}2.33 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$10.8 \mathrm{ms} \pm 112 \mathrm{μs}\left({\color{gray}3.23 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$10.8 \mathrm{ms} \pm 84.1 \mathrm{μs}\left({\color{gray}2.62 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$10.9 \mathrm{ms} \pm 102 \mathrm{μs}\left({\color{gray}4.81 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$11.2 \mathrm{ms} \pm 99.3 \mathrm{μs}\left({\color{red}8.17 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$10.8 \mathrm{ms} \pm 118 \mathrm{μs}\left({\color{gray}4.31 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$11.0 \mathrm{ms} \pm 113 \mathrm{μs}\left({\color{gray}3.90 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$10.9 \mathrm{ms} \pm 88.4 \mathrm{μs}\left({\color{gray}-2.473 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1	$$12.0 \mathrm{ms} \pm 89.3 \mathrm{μs}\left({\color{red}8.34 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1	$$12.4 \mathrm{ms} \pm 93.4 \mathrm{μs}\left({\color{red}14.3 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1	$$11.8 \mathrm{ms} \pm 169 \mathrm{μs}\left({\color{red}9.20 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1	$$12.2 \mathrm{ms} \pm 90.3 \mathrm{μs}\left({\color{red}13.9 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2	$$12.8 \mathrm{ms} \pm 234 \mathrm{μs}\left({\color{red}17.3 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1	$$12.3 \mathrm{ms} \pm 119 \mathrm{μs}\left({\color{red}13.2 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1	$$12.2 \mathrm{ms} \pm 122 \mathrm{μs}\left({\color{red}14.3 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1	$$12.2 \mathrm{ms} \pm 136 \mathrm{μs}\left({\color{red}14.3 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1	$$12.5 \mathrm{ms} \pm 124 \mathrm{μs}\left({\color{red}13.8 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba	$$8.91 \mathrm{ms} \pm 165 \mathrm{μs}\left({\color{red}13.2 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$58.2 \mathrm{ms} \pm 602 \mathrm{μs}\left({\color{gray}3.53 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$110 \mathrm{ms} \pm 596 \mathrm{μs}\left({\color{gray}1.58 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$64.5 \mathrm{ms} \pm 549 \mathrm{μs}\left({\color{gray}2.62 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$72.9 \mathrm{ms} \pm 466 \mathrm{μs}\left({\color{gray}1.92 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$83.9 \mathrm{ms} \pm 1.18 \mathrm{ms}\left({\color{red}5.36 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$89.3 \mathrm{ms} \pm 639 \mathrm{μs}\left({\color{gray}3.59 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$46.8 \mathrm{ms} \pm 318 \mathrm{μs}\left({\color{gray}2.84 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$73.6 \mathrm{ms} \pm 516 \mathrm{μs}\left({\color{gray}1.77 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$54.6 \mathrm{ms} \pm 896 \mathrm{μs}\left({\color{red}5.68 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$62.2 \mathrm{ms} \pm 457 \mathrm{μs}\left({\color{gray}4.38 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$64.4 \mathrm{ms} \pm 567 \mathrm{μs}\left({\color{gray}4.32 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$63.8 \mathrm{ms} \pm 394 \mathrm{μs}\left({\color{gray}3.45 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$122 \mathrm{ms} \pm 641 \mathrm{μs}\left({\color{gray}4.23 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$135 \mathrm{ms} \pm 1.36 \mathrm{ms}\left({\color{gray}4.28 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$23.8 \mathrm{ms} \pm 187 \mathrm{μs}\left({\color{gray}4.98 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$540 \mathrm{ms} \pm 1.81 \mathrm{ms}\left({\color{gray}3.08 \mathrm{\%}}\right) $$	Flame Graph