Repository navigation
fix(deps): bump certifi to 2026.10.19 - #593
Conversation
certifi 2026.10.19 removes the emSign ECC Root CA - G3 root after eight eMudhra intermediate CA private keys were compromised (https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html). requests and httpx trust certifi's bundle and do not check revocation. Bump the locked certifi and release 0.1.16. The certifi requirement for installs is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 3 files
Shadow auto-approve: would not auto-approve because issues were found.
View guided diff | Re-trigger cubic
certifi 2026.10.19 drops the emSign ECC Root CA - G3 root after the eMudhra intermediate CA key compromise. Record the floor in [tool.uv] constraint-dependencies so relocks keep it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
There was a problem hiding this comment.
All reported issues were addressed across 3 files (changes from recent commits).
Shadow auto-approve: would not auto-approve. Auto-approval blocked by 1 unresolved issue from previous reviews.
View guided diff | Re-trigger cubic
There was a problem hiding this comment.
0 issues found across 2 files (changes from recent commits).
Shadow auto-approve: would require human review. Bumps certifi to 2026.10.19 and uv in the Docker image to 0.13.4 for CA-trust fixes; certifi is a TLS/identity trust package, so Class A condition 5 excludes auto-approval.
View guided diff | Re-trigger cubic
Why
Eight eMudhra intermediate CA private keys were confirmed compromised (article). certifi 2026.10.19 drops the emSign ECC Root CA - G3 root.
requestsandhttpxtrust certifi's bundle and do not check revocation, so the older bundle accepts certificates chaining to that root.What
uv.lock:certifiupgraded to 2026.10.19 (uv lock --upgrade-package certifi; no other packages changed).0.1.16with a CHANGELOG entry.Dockerfile: uv 0.10.0 -> 0.13.4. uv before 0.13.4 bundles a CA store that trusts the same emSign root (GHSA-hq85-5cpj-mr62).certififloor added topyproject.toml, so downstream installs are not constrained.Tests: lock consistency checked locally; full suites left to CI.
Also adds
certifi>=2026.10.19to[tool.uv] constraint-dependencies, so future relocks can't fall below it.🤖 Generated with Claude Code