From 497fbc029f046a82faf90aa1a877901296fa8efe Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 22 Oct 2026 13:56:27 +0000 Subject: [PATCH] Bump uv to 0.13.4 and certifi to 2026.10.19 Eight eMudhra intermediate CA private keys were broken, so anyone holding them can impersonate TLS servers to clients that still trust emSign ECC Root CA - G3. uv 0.13.4 and certifi 2026.10.19 are the first releases whose bundled CA store drops that root, and the versions pinned here still trust it. See the Python.org notice. https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01T4ck1tYoQv3mzBTXH17asD --- Dockerfile | 2 +- pyproject.toml | 2 +- uv.lock | 11 ++++++----- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/Dockerfile b/Dockerfile index 69c61c9..3fd7935 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM ghcr.io/astral-sh/uv:0.7 AS uv +FROM ghcr.io/astral-sh/uv:0.13.4 AS uv FROM python:3.12-slim AS builder COPY --from=uv /uv /usr/local/bin/uv diff --git a/pyproject.toml b/pyproject.toml index 11340f2..94799e4 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -159,7 +159,7 @@ exclude-newer = "7 days" # this date is bumped alongside an intentional version bump. Bumped for # 1.4.0, published 2026-10-21, for the `author` / `message` keywords on # every DDL call. -exclude-newer-package = { pyducklake = "2026-08-14T00:00:00Z", pyhoglake = "2026-10-22T00:00:00Z" } +exclude-newer-package = { pyducklake = "2026-08-14T00:00:00Z", pyhoglake = "2026-10-22T00:00:00Z", certifi = "1 day" } constraint-dependencies = [ "pygments>=2.20.0", "requests>=2.33.0", diff --git a/uv.lock b/uv.lock index 3bd186b..d1ca43d 100644 --- a/uv.lock +++ b/uv.lock @@ -1,12 +1,13 @@ version = 1 -revision = 3 +revision = 5 requires-python = ">=3.12" [options] -exclude-newer = "2026-10-14T19:08:17.472174Z" +exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values. exclude-newer-span = "P7D" [options.exclude-newer-package] +certifi = { timestamp = "0001-01-01T00:00:00Z", span = "P1D" } pyducklake = "2026-08-14T00:00:00Z" pyhoglake = "2026-10-22T00:00:00Z" @@ -73,11 +74,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.2.25" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/af/2d/7bf41579a8986e348fa033a31cdd0e4121114f6bce2457e8876010b092dd/certifi-2026.2.25.tar.gz", hash = "sha256:e887ab5cee78ea814d3472169153c2d12cd43b14bd03329a39a9c6e2e80bfba7", size = 155029, upload-time = "2026-02-25T02:54:17.342Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/9a/3c/c17fb3ca2d9c3acff52e30b309f538586f9f5b9c9cf454f3845fc9af4881/certifi-2026.2.25-py3-none-any.whl", hash = "sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa", size = 153684, upload-time = "2026-02-25T02:54:15.766Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]]