[damccorm]

Cherry-picks #40811 and #40889 to release-2.78:

• Bump certifi==2026.10.23, grpcio==1.85.0, grpcio-status==1.85.0, and httplib2==0.32.1 across Python and ML container image requirements files.
• Update Go, Java, and Python distroless base images from *-debian12 to *-debian13.
• Remove distrusted emsign / emudhra root CA entries from the OpenJDK cacerts truststore in Java container images.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.39%. Comparing base (3b59922) to head (6c16739).
⚠️ Report is 2 commits behind head on release-2.78.

Additional details and impacted files

@@                Coverage Diff                @@
##           release-2.78   #40890       +/-   ##
=================================================
+ Coverage              0   56.39%   +56.39%     
=================================================
  Files                 0      876      +876     
  Lines                 0   154789   +154789     
=================================================
+ Hits                  0    87298    +87298     
- Misses                0    65636    +65636     
- Partials              0     1855     +1855     

Flag	Coverage Δ
go	28.90% <ø> (?)
python	79.82% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[damccorm]

R: @Abacn

[github-actions]

Stopping reviewer notifications for this pull request: review requested by someone other than the bot, ceding control. If you'd like to restart, comment assign set of reviewers

[github-actions]

📋 Review Summary

This PR cleanly cherry-picks #40811 and #40889 onto the release-2.78 branch to update container CA dependencies (certifi, grpcio, grpcio-status, and httplib2), upgrade distroless base images from debian12 to debian13, and remove distrusted eMudhra/emSign root CA certificates from Java container truststores.

🔍 General Feedback

• The cherry-picked diffs across all 21 container and requirements files match the upstream changes in #40811 and #40889 without discrepancies or conflicts.
• Both standard and distroless Java images properly propagate the sanitized cacerts truststore.

---

💡 Tip: Comment /gemini review on this pull request to trigger a new Gemini code review.