[calvin-archastro]

Review on ArchCode

Problem

The eMudhra intermediate CA compromise (disclosed 2026-10-20, https://emudhra.we-have-a-problem.com) is fixed in certifi 2026.10.19 by removing the CA from the bundle. uv.lock pins certifi 2026.2.25, so CI, dev environments and uv exported runtime requirements (hash-pinned wheel smoke test) still trust it.

What changed

• certifi 2026.2.25 -> 2026.10.19 via uv lock --upgrade-package certifi
• uv.lock only (3 lines: version, sdist and wheel URLs/hashes). No transitive bumps.
• Second commit: new npm advisories (published after main's last green run on 2026-09-24) failed the Audit JS tooling dependencies step on every CI job, so it is cleared here:
  • fast-uri override 4.1.4 -> 4.1.5 (GHSA-hrr3-gc8f-f4qj, GHSA-jvvf-x445-j334)
  • js-yaml override 5.2.3 -> 5.4.1 (GHSA-r3ph-w7gj-g6xm)
  • braces GHSA-vfj7-8cjw-p6xm: no patched release exists (all <= 3.0.3). Added a dated waiver (expires 2026-12-31) to scripts/audit-js-tooling.mjs. It reaches us only via chokidar 3.6.0 under @stoplight/prism-cli, which watches the one spec path we pass to prism mock with disableGlobbing: true, so braces never expands a pattern. Dev-only; not in the wheel.

Scope

Backend-only: Python lockfile plus JS dev-tooling lockfile/overrides and the audit allowlist.

Risk

Low. certifi is a data-only package; the SDK does not pin it in pyproject.toml, so installed users get whatever they resolve.

User impact

Locked environments stop trusting the compromised intermediate. Users resolving their own dependencies should upgrade certifi themselves.

Testing

• uv sync --locked --all-extras: pass
• ruff check, ruff format --check: pass
• node scripts/audit-js-tooling.mjs: clean (waived: GHSA-qxc2-j82w-r537, GHSA-vfj7-8cjw-p6xm)
• After the override bumps: pytest tests/contract 3036 passed (exercises Prism with the new js-yaml/fast-uri); pytest tests/harness tests/test_http_client.py src/archastro/phx_channel/tests/test_unit.py tests/examples 117 passed
• pytest tests/harness tests/contract (ARCHASTRO_RUN_CHANNEL_CONTRACT_TESTS=1) and the unit/examples set from CI: pass (3042 and 3036 passed in the full runs; harness needs npm ci --ignore-scripts first)

Follow-ups

• Remove the braces waiver when braces ships a fix (the script fails on expiry 2026-12-31).
• No release required; no minimum certifi is declared, so no release is needed unless a floor is wanted.

🤖 Generated with Claude Code