From 30ba3179a107de4af3b3e103acd9d84f2bf8952c Mon Sep 17 00:00:00 2001 From: Anthony Volk <14987227+anth-volk@users.noreply.github.com> Date: Thu, 22 Oct 2026 01:56:39 +0400 Subject: [PATCH] Lock certifi 2026.10.19 to stop trusting the compromised eMudhra CA certifi 2025.11.12 still includes "emSign ECC Root CA - G3", whose intermediate CA private keys were generated incorrectly and can be recovered from the public certificates. httpx, which fetches publisher artifacts and backs the Supabase client, reads certifi's CA list. Updated with "uv lock --upgrade-package certifi" using uv 0.13.4, the version setup-uv installs in CI. Co-Authored-By: Claude Opus 5.5 --- changelog.d/emudhra-ca-trust-update.fixed.md | 3 +++ uv.lock | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) create mode 100644 changelog.d/emudhra-ca-trust-update.fixed.md diff --git a/changelog.d/emudhra-ca-trust-update.fixed.md b/changelog.d/emudhra-ca-trust-update.fixed.md new file mode 100644 index 00000000..9e2253c0 --- /dev/null +++ b/changelog.d/emudhra-ca-trust-update.fixed.md @@ -0,0 +1,3 @@ +Lock certifi 2026.10.19, which removes the compromised eMudhra root "emSign ECC +Root CA - G3", so the httpx downloads of publisher artifacts and the Supabase +client stop trusting certificates issued under it. diff --git a/uv.lock b/uv.lock index 44cca7aa..ab20faaa 100644 --- a/uv.lock +++ b/uv.lock @@ -1,5 +1,5 @@ version = 1 -revision = 3 +revision = 5 requires-python = ">=3.11" resolution-markers = [ "python_full_version >= '3.12'", @@ -48,11 +48,11 @@ wheels = [ [[package]] name = "certifi" -version = "2025.11.12" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/a2/8c/58f469717fa48465e4a50c014a0400602d3c437d7c0c468e17ada824da3a/certifi-2025.11.12.tar.gz", hash = "sha256:d8ab5478f2ecd78af242878415affce761ca6bc54a22a27e026d7c25357c3316", size = 160538, upload-time = "2025-11-12T02:54:51.517Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/70/7d/9bc192684cea499815ff478dfcdc13835ddf401365057044fb721ec6bddb/certifi-2025.11.12-py3-none-any.whl", hash = "sha256:97de8790030bbd5c2d96b7ec782fc2f7820ef8dba6db909ccf95449f2d062d4b", size = 159438, upload-time = "2025-11-12T02:54:49.735Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]]