diff --git a/.github/scripts/requirements-sentry.txt b/.github/scripts/requirements-sentry.txt
index 4ee80825..d9a073c4 100644
--- a/.github/scripts/requirements-sentry.txt
+++ b/.github/scripts/requirements-sentry.txt
@@ -2,9 +2,9 @@
 # (used by .github/workflows/sentry-to-github.yml with pip --require-hashes).
 # Regenerate with:
 #   echo requests > req.in && uv pip compile req.in --generate-hashes --python-version 3.12 --no-header -o .github/scripts/requirements-sentry.txt
-certifi==2026.7.22 \
-    --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \
-    --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55
+certifi==2026.10.19 \
+    --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \
+    --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b
     # via requests
 charset-normalizer==3.5.1 \
     --hash=sha256:00668ebb0609751758682eb0b5857e7c35b9f00e84dfdef062e103244ec94d45 \
diff --git a/pkg/schema/mysql/loader_test.go b/pkg/schema/mysql/loader_test.go
index 81d37515..a6bba3f5 100644
--- a/pkg/schema/mysql/loader_test.go
+++ b/pkg/schema/mysql/loader_test.go
@@ -76,6 +76,11 @@ func startMySQLImage(t *testing.T, image string, env map[string]string, waitFor
 		t.Skip("Docker not available, skipping integration test")
 	}
 	ctx := context.Background()
+	// Bound the container start by the test binary's deadline. A slow image
+	// pull or server init on CI otherwise runs into the -timeout panic, which
+	// fails the whole package instead of skipping this integration test.
+	startCtx, cancel := containerStartContext(ctx, t)
+	defer cancel()
 	req := testcontainers.ContainerRequest{
 		Image:        image,
 		ExposedPorts: []string{"3306/tcp"},
@@ -92,12 +97,15 @@ func startMySQLImage(t *testing.T, image string, env map[string]string, waitFor
 				t.Skipf("testcontainers panicked: %v", r)
 			}
 		}()
-		c, err = testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
+		c, err = testcontainers.GenericContainer(startCtx, testcontainers.GenericContainerRequest{
 			ContainerRequest: req,
 			Started:          true,
 		})
 	}()
 	if err != nil {
+		if startCtx.Err() != nil {
+			t.Skipf("container start exceeded its time budget (%v): %v", startCtx.Err(), err)
+		}
 		t.Skipf("testcontainers unavailable: %v", err)
 	}
 	t.Cleanup(func() { _ = c.Terminate(ctx) })
@@ -401,3 +409,16 @@ func TestMySQLLoader_LoadTable_EmptyName(t *testing.T) {
 		t.Fatal("expected error for empty table name")
 	}
 }
+
+// containerStartContext bounds one container start. Each start gets at most
+// 75s and always ends 30s before the test binary's deadline, which all tests
+// in the package share. A slow start therefore cannot consume the whole
+// package budget, and a skip caused by it is reported as such.
+func containerStartContext(ctx context.Context, t *testing.T) (context.Context, context.CancelFunc) {
+	t.Helper()
+	end := time.Now().Add(75 * time.Second)
+	if deadline, ok := t.Deadline(); ok && deadline.Add(-30*time.Second).Before(end) {
+		end = deadline.Add(-30 * time.Second)
+	}
+	return context.WithDeadline(ctx, end)
+}
diff --git a/pkg/schema/postgres/loader_test.go b/pkg/schema/postgres/loader_test.go
index 12fb9fde..60496fc1 100644
--- a/pkg/schema/postgres/loader_test.go
+++ b/pkg/schema/postgres/loader_test.go
@@ -63,6 +63,10 @@ func startPostgresServer(t *testing.T) (db *sql.DB, host, port string) {
 		t.Skip("Docker not available, skipping integration test")
 	}
 	ctx := context.Background()
+	// Bound the container start by the test binary's deadline so a slow CI
+	// pull or init skips this integration test instead of panicking the package.
+	startCtx, cancel := containerStartContext(ctx, t)
+	defer cancel()
 	req := testcontainers.ContainerRequest{
 		Image:        "postgres:16-alpine",
 		ExposedPorts: []string{"5432/tcp"},
@@ -83,12 +87,15 @@ func startPostgresServer(t *testing.T) (db *sql.DB, host, port string) {
 				t.Skipf("testcontainers panicked: %v", r)
 			}
 		}()
-		c, err = testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
+		c, err = testcontainers.GenericContainer(startCtx, testcontainers.GenericContainerRequest{
 			ContainerRequest: req,
 			Started:          true,
 		})
 	}()
 	if err != nil {
+		if startCtx.Err() != nil {
+			t.Skipf("container start exceeded its time budget (%v): %v", startCtx.Err(), err)
+		}
 		t.Skipf("testcontainers unavailable: %v", err)
 	}
 	t.Cleanup(func() { _ = c.Terminate(ctx) })
@@ -640,3 +647,16 @@ func TestPostgresLoader_LoadTable_EmptyName(t *testing.T) {
 		t.Fatal("expected error for empty table name")
 	}
 }
+
+// containerStartContext bounds one container start. Each start gets at most
+// 75s and always ends 30s before the test binary's deadline, which all tests
+// in the package share. A slow start therefore cannot consume the whole
+// package budget, and a skip caused by it is reported as such.
+func containerStartContext(ctx context.Context, t *testing.T) (context.Context, context.CancelFunc) {
+	t.Helper()
+	end := time.Now().Add(75 * time.Second)
+	if deadline, ok := t.Deadline(); ok && deadline.Add(-30*time.Second).Before(end) {
+		end = deadline.Add(-30 * time.Second)
+	}
+	return context.WithDeadline(ctx, end)
+}
diff --git a/vscode-extension/package-lock.json b/vscode-extension/package-lock.json
index 4e0bdd52..2b87d74d 100644
--- a/vscode-extension/package-lock.json
+++ b/vscode-extension/package-lock.json
@@ -3811,9 +3811,9 @@
       }
     },
     "node_modules/markdown-it": {
-      "version": "14.3.2",
-      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.2.tgz",
-      "integrity": "sha512-sHHjZ5fJKlgrG4qns2YwVcdNep35h5fERrfkD2YNsb9UFk0UIHarbiTaHKVMlPuWAoiilyK8Fv/jAm11slsY7Q==",
+      "version": "14.3.3",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.3.tgz",
+      "integrity": "sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg==",
       "dev": true,
       "funding": [
         {