Replace temporary certifi fork with upstream 2.18.0

Dockerfile

@@ -148,7 +148,6 @@ FROM builder_base AS builder
 
 # install mix dependencies
 COPY mix.exs mix.lock ./
-COPY vendor vendor
 RUN mix deps.get --only $MIX_ENV
 RUN mkdir config
 

deploy/licenses/collect.sh

@@ -27,7 +27,7 @@ cp -R deploy/licenses/device-detector "$output_dir/data/"
 
 # Keep original relative paths so identically named notices cannot overwrite
 # each other. Include transitive dependencies, not just direct package names.
-find deps vendor assets/node_modules \
+find deps assets/node_modules \
   -type d \( -name .git -o -name _build -o -name target \) -prune -o \
   -type f \( -iname 'license*' -o -iname 'licence*' -o -iname 'copying*' \
     -o -iname 'notice*' -o -iname 'copyright*' -o -name Cargo.lock \

mix.exs

@@ -77,8 +77,8 @@ defmodule MaveCore.MixProject do
       # Keep consuming applications above the patched HTTP/1 and HTTP/2 baseline.
       {:mint, ">= 1.11.0 and < 2.0.0"},
       {:castore, "~> 1.0.22"},
-      # Temporary CA distrust until upstream certifi ships the removal.
-      {:certifi, path: "vendor/certifi", override: true},
+      # Override older transitive constraints to retain the upstream CA distrust.
+      {:certifi, "~> 2.18.0", override: true},
       {:req_s3, "~> 0.2.5"},
       {:telemetry_metrics, "~> 1.0"},
       {:telemetry_poller, "~> 1.0"},

mix.lock

@@ -4,6 +4,7 @@
   "bunt": {:hex, :bunt, "1.0.0", "081c2c665f086849e6d57900292b3a161727ab40431219529f13c4ddcf3e7a44", [:mix], [], "hexpm", "dc5f86aa08a5f6fa6b8096f0735c4e76d54ae5c9fa2c143e5a1fc7c1cd9bb6b5"},
   "castore": {:hex, :castore, "1.0.22", "a01978e6a5d42fa3a34143630588f92036e7d90e2309ecdd466722d1279a2213", [:mix], [], "hexpm", "c2a4d42723b4affbc1c3e15d8f6df3f7d8f1f627c84de643383634cce58493d5"},
   "cc_precompiler": {:hex, :cc_precompiler, "0.1.11", "8c844d0b9fb98a3edea067f94f616b3f6b29b959b6b3bf25fee94ffe34364768", [:mix], [{:elixir_make, "~> 0.7", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "3427232caf0835f94680e5bcf082408a70b48ad68a5f5c0b02a3bea9f3a075b9"},
+  "certifi": {:hex, :certifi, "2.18.0", "bd5f34eb8fe7c3eee3c705c1f9472174e8d4c353fc9c09a4cb937b891e80e329", [:rebar3], [], "hexpm", "a8b61115e393a2298b20451a36beffdabe08e61bc16cc1926d7991f6721103bf"},
   "ch": {:hex, :ch, "0.8.3", "c23a8200e63a430c833848f92b31b85ec235fe406f38f532d31144152293b974", [:mix], [{:db_connection, "~> 2.10.1", [hex: :db_connection, repo: "hexpm", optional: false]}, {:decimal, "~> 2.0 or ~> 3.0", [hex: :decimal, repo: "hexpm", optional: false]}, {:ecto, "~> 3.13.0", [hex: :ecto, repo: "hexpm", optional: true]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:mint, "~> 1.0", [hex: :mint, repo: "hexpm", optional: false]}], "hexpm", "3666babdd2130c3731422b7387b6d7a591f501681e3b840c49d44207772ca954"},
   "cors_plug": {:hex, :cors_plug, "3.0.3", "7c3ac52b39624bc616db2e937c282f3f623f25f8d550068b6710e58d04a0e330", [:mix], [{:plug, "~> 1.13", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "3f2d759e8c272ed3835fab2ef11b46bddab8c1ab9528167bd463b6452edf830d"},
   "credo": {:hex, :credo, "1.7.18", "5c5596bf7aedf9c8c227f13272ac499fe8eae6237bd326f2f07dfc173786f042", [:mix], [{:bunt, "~> 0.2.1 or ~> 1.0", [hex: :bunt, repo: "hexpm", optional: false]}, {:file_system, "~> 0.2 or ~> 1.0", [hex: :file_system, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "a189d164685fd945809e862fe76a7420c4398fa288d76257662aecb909d6b3e5"},

test/mave_core/distribution_notices_test.exs

@@ -19,7 +19,7 @@ defmodule MaveCore.DistributionNoticesTest do
       "deploy/licenses/device-detector/LICENSE" => "Data licence",
       "deploy/licenses/device-detector/NOTICE" => "Data attribution",
       "deps/example/LICENSE.md" => "Example licence",
-      "vendor/certifi/LICENSE" => "Vendored CA bundle licence",
+      "deps/certifi/LICENSE" => "CA bundle licence",
       "deps/example/hex_metadata.config" => "Package metadata",
       "deps/example/native/Cargo.lock" => "Native dependency versions",
       "deps/example/third party/NOTICE" => "Nested attribution",
@@ -46,7 +46,7 @@ defmodule MaveCore.DistributionNoticesTest do
           "THIRD_PARTY_NOTICES.md",
           "Dockerfile",
           "deps/example/LICENSE.md",
-          "vendor/certifi/LICENSE",
+          "deps/certifi/LICENSE",
           "deps/example/hex_metadata.config",
           "deps/example/native/Cargo.lock",
           "deps/example/third party/NOTICE",