Repository navigation
fix(deps): require certifi>=2026.10.19 to drop the compromised eMudhra root - #38
Merged
Merged
Conversation
…a root Eight eMudhra intermediate CA keys were found to be recoverable in under a second. Clients that do not get browser blocklists still trust chains from them. certifi 2026.10.19 removes the emSign ECC Root CA - G3 root. certifi comes in through requests and had no floor. An existing venv that already had an older certifi kept it when upgrade-python-package was upgraded. The floor makes the next upgrade pull the fixed bundle. [changelog] Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
renatav
approved these changes
Oct 23, 2026
balsa-sarenac
added a commit
that referenced
this pull request
Oct 23, 2026
Review feedback asked for more concise entries. Use one short sentence per entry, as in earlier releases, and link the certifi fix to #38. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
balsa-sarenac
added a commit
that referenced
this pull request
Oct 23, 2026
Review feedback asked for more concise entries. Use one short sentence per entry, as in earlier releases, and link the certifi fix to #38. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds
certifi>=2026.10.19to the dependencies and a changelog line.On 17 Oct 2026 a researcher showed that eight eMudhra intermediate CA keys were weak and could be recovered in seconds. Browsers have blocked the certificates. Python clients that use
certifistill trusted them untilcertifi2026.10.19, which removes theemSign ECC Root CA - G3root. See https://blog.talosintelligence.com/compromised-intermediate-certificates/ and https://emudhra.we-have-a-problem.com/.certificomes in throughrequestsand had no lower bound.mainhas no tracked lock file, so a fresh install already gets the latest. The gap is existing virtual environments. With pip's default upgrade strategy, upgradingupgrade-python-packagekeeps an oldercertifithat already satisfiesrequests. The floor forces the upgrade.certifi2026.10.19 needs Python >=3.7, so the supported range (3.8 and up) is unaffected.How to test
🤖 Generated with Claude Code