[Phantom9869]

Summary

Follow-ups after the redirect/DNS/TLS hardening on main (a8e4529).

Python 3.13 CA fixture

test_pinned_https_honours_requests_ca_bundle_and_rejects_hostname_mismatch minted a bare self-signed certificate and trusted it as its own CA. Python 3.13's default VERIFY_X509_STRICT rejects that with CA cert does not include key usage extension. The helper now builds a CA (basicConstraints=critical,CA:TRUE, keyUsage=critical,keyCertSign,cRLSign) and signs a leaf that has a SAN and serverAuth. CI runs 3.11, 3.12, and 3.13. pip-audit is unchanged.

--insecure

HTTPS certificate failures still stop the web modules (Could not fetch site ... not retrying over HTTP), which blocks pentests against self-signed appliances. --insecure is off by default and disables certificate verification for HTTPS fetches. It does not retry a certificate failure over plain HTTP. A protocol mismatch (plain HTTP on the HTTPS port) still falls back. The choice is printed on stderr, prefixed on text and Markdown reports, and stored as an INFO finding (including JSON). Documented in --help and the README.

crt.sh is a third party, so that request passes verify=True even when --insecure is set. The TLS module still does a verified handshake first to classify hostname mismatch, self-signed, and untrusted-chain findings, then an unverified handshake for expiry and protocol details.

DNS thread lifetime

resolve_ips still uses one system getaddrinfo (so /etc/hosts works) and still returns when the deadline hits. Hung lookups cannot be cancelled. A shared semaphore allows at most 16 daemon threads in libc at once, enough that a burst of slow healthy lookups finishes inside one deadline. Extra hosts wait only until their own deadline, then return []. That skip is logged and exposed as resolution_saturated / ResolverSaturated (the pipeline and the port check report it). It is not cached. Only non-empty answers are cached, so a transient EAI_AGAIN is retried on the next lookup.

set_tls_verification installs the urllib3 warning filter once per transition instead of stacking a new filter on every call.

Windows CI on 72df5ad

All six Windows jobs failed test_saturated_resolver_is_signalled_and_not_cached. An earlier test left a getaddrinfo sleeper holding one process-wide resolver slot. On Windows that slot freed between the two saturation probes, so the second probe acquired it, started a real lookup, and cleared the saturated flag. Ubuntu was fast enough that the sleeper had already exited. a490bd6 joins leftover resolver threads and keeps the pool full until both probes finish. Product saturation behavior is unchanged.

Tests

• Python 3.11.17: 198 passed (local, before the Windows-only test change)
• Python 3.12.3: 198 passed
• Python 3.13.17: 198 passed
• tests/test_net.py after the isolation fix: 12 passed
• pip-audit --requirement requirements.txt: no known vulnerabilities

Commit dates (git log main..HEAD --format='%H %ad | %cd' --date=iso)

a490bd64957a8134d3d6a0d41c1cb52a75b971b3 2026-10-23 23:10:00 +0530 | 2026-10-23 23:10:00 +0530
72df5adab767ba03ba9631665002f79a3714701c 2026-10-23 22:30:00 +0530 | 2026-10-23 22:30:00 +0530
163f0604635844fc984cb77206b8fc02da83e2e6 2026-10-23 21:15:00 +0530 | 2026-10-23 21:15:00 +0530