From 852eddab9aab8d7c04f878afc358c79be9c1c66c Mon Sep 17 00:00:00 2001 From: Lawrence Elitzer Date: Tue, 20 Oct 2026 14:22:07 -0500 Subject: [PATCH 1/3] fix(deps): bump certifi to 2026.10.19 certifi 2026.10.19 removes the emSign ECC Root CA - G3 root after eight eMudhra intermediate CA private keys were compromised (https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html). requests and httpx trust certifi's bundle and do not check revocation. Bump the locked certifi and release 0.1.16. The certifi requirement for installs is unchanged. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 6 ++++++ prepline_general/api/__version__.py | 2 +- uv.lock | 6 +++--- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 59c33c26..bc3dd0f3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,9 @@ +## 0.1.16 + +### Fixes + +- **Bump locked `certifi` to 2026.10.19**: The release removes the emSign ECC Root CA - G3 root after eight eMudhra intermediate CA private keys were compromised. `requests` and `httpx` trust certifi's bundle and do not check revocation, so with the older bundle they accepted certificates chaining to that root. The Docker image installs from the lockfile and picks it up. + ## 0.1.15 ### Fixes diff --git a/prepline_general/api/__version__.py b/prepline_general/api/__version__.py index 9ada8c84..d7e5d581 100644 --- a/prepline_general/api/__version__.py +++ b/prepline_general/api/__version__.py @@ -1 +1 @@ -__version__ = "0.1.15" # pragma: no cover +__version__ = "0.1.16" # pragma: no cover diff --git a/uv.lock b/uv.lock index 2f97851c..8a1d284b 100644 --- a/uv.lock +++ b/uv.lock @@ -156,11 +156,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.4.22" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/25/ee/6caf7a40c36a1220410afe15a1cc64993a1f864871f698c0f93acb72842a/certifi-2026.4.22.tar.gz", hash = "sha256:8d455352a37b71bf76a79caa83a3d6c25afee4a385d632127b6afb3963f1c580", size = 137077, upload-time = "2026-04-22T11:26:11.191Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/22/30/7cd8fdcdfbc5b869528b079bfb76dcdf6056b1a2097a662e5e8c04f42965/certifi-2026.4.22-py3-none-any.whl", hash = "sha256:3cb2210c8f88ba2318d29b0388d1023c8492ff72ecdde4ebdaddbb13a31b1c4a", size = 135707, upload-time = "2026-04-22T11:26:09.372Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] From ea2d4a6d55eeeb00d7365c624f57d31709186fc6 Mon Sep 17 00:00:00 2001 From: Lawrence Elitzer Date: Tue, 20 Oct 2026 15:51:29 -0500 Subject: [PATCH 2/3] fix(deps): require certifi>=2026.10.19 certifi 2026.10.19 drops the emSign ECC Root CA - G3 root after the eMudhra intermediate CA key compromise. Record the floor in [tool.uv] constraint-dependencies so relocks keep it. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 2 +- pyproject.toml | 2 ++ uv.lock | 1 + 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bc3dd0f3..26f2cab2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ ### Fixes -- **Bump locked `certifi` to 2026.10.19**: The release removes the emSign ECC Root CA - G3 root after eight eMudhra intermediate CA private keys were compromised. `requests` and `httpx` trust certifi's bundle and do not check revocation, so with the older bundle they accepted certificates chaining to that root. The Docker image installs from the lockfile and picks it up. +- **Bump locked `certifi` to 2026.10.19**: The release removes the emSign ECC Root CA - G3 root after eight eMudhra intermediate CA private keys were compromised. `requests` and `httpx` trust certifi's bundle and do not check revocation, so with the older bundle they accepted certificates chaining to that root. The Docker image installs from the lockfile and picks it up, and `certifi>=2026.10.19` is recorded in `constraint-dependencies` so future relocks cannot fall below it. ## 0.1.15 diff --git a/pyproject.toml b/pyproject.toml index 70220775..0668cd7e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -52,6 +52,8 @@ constraint-dependencies = [ "starlette>=1.1.0", # lxml >=6.1.1 fixes CVE-2026-41066 (HIGH) "lxml>=6.1.1", + # certifi >=2026.10.19 removes emSign ECC Root CA - G3 (eMudhra intermediate CA key compromise) + "certifi>=2026.10.19", ] [[tool.uv.index]] diff --git a/uv.lock b/uv.lock index 8a1d284b..576451b6 100644 --- a/uv.lock +++ b/uv.lock @@ -28,6 +28,7 @@ resolution-markers = [ [manifest] constraints = [ + { name = "certifi", specifier = ">=2026.10.19" }, { name = "lxml", specifier = ">=6.1.1" }, { name = "pdfminer-six", specifier = "==20260107" }, { name = "starlette", specifier = ">=1.1.0" }, From 45c1ad61e48a9acdf28564e0885edd62818983f6 Mon Sep 17 00:00:00 2001 From: Lawrence Elitzer Date: Tue, 20 Oct 2026 17:28:40 -0500 Subject: [PATCH 3/3] fix(docker): bump uv to 0.13.4 (emSign root removal, GHSA-hq85-5cpj-mr62) uv before 0.13.4 bundles a CA store that trusts the emSign ECC Root CA - G3, the root of the compromised eMudhra intermediates. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 1 + Dockerfile | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 26f2cab2..1e7394c9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ ### Fixes - **Bump locked `certifi` to 2026.10.19**: The release removes the emSign ECC Root CA - G3 root after eight eMudhra intermediate CA private keys were compromised. `requests` and `httpx` trust certifi's bundle and do not check revocation, so with the older bundle they accepted certificates chaining to that root. The Docker image installs from the lockfile and picks it up, and `certifi>=2026.10.19` is recorded in `constraint-dependencies` so future relocks cannot fall below it. +- **Bump uv in the Docker image to 0.13.4**: Earlier uv releases bundle a CA store that trusts the same emSign ECC Root CA - G3 ([GHSA-hq85-5cpj-mr62](https://github.com/astral-sh/uv/security/advisories/GHSA-hq85-5cpj-mr62)). uv 0.13.4 drops it, so package downloads during the image build no longer trust certificates chaining to that root. ## 0.1.15 diff --git a/Dockerfile b/Dockerfile index 40ed4cbc..ff91c5d6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,7 +11,7 @@ ARG PYTHON_VERSION="3.12" # Set up environment ENV PYTHON=python${PYTHON_VERSION} -COPY --from=ghcr.io/astral-sh/uv:0.10.0 /uv /usr/local/bin/uv +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv USER root