From f3898c6de60603c3e1ab6134ddf670c3d5a4453d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bal=C5=A1a=20=C5=A0arenac?= Date: Fri, 23 Oct 2026 11:54:35 +0200 Subject: [PATCH] fix(deps): require certifi>=2026.10.19 to drop the compromised eMudhra root Eight eMudhra intermediate CA keys were found to be recoverable in under a second. Clients that do not get browser blocklists still trust chains from them. certifi 2026.10.19 removes the emSign ECC Root CA - G3 root. certifi comes in through requests and had no floor. An existing venv that already had an older certifi kept it when upgrade-python-package was upgraded. The floor makes the next upgrade pull the fixed bundle. [changelog] Co-Authored-By: Claude Sonnet 5.5 --- CHANGELOG.md | 2 ++ pyproject.toml | 1 + 2 files changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index fd402a6..5cea0c4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,8 @@ and this project adheres to a _modified_ form of _[Semantic Versioning][semver]_ ### Fixed +- Require `certifi>=2026.10.19` so installs drop the compromised eMudhra `emSign ECC Root CA - G3` root. + ### Removed ## [0.9.4] diff --git a/pyproject.toml b/pyproject.toml index 1c0a01c..b194253 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -35,6 +35,7 @@ classifiers = [ dependencies = [ "lxml>=4.9", "requests==2.*", + "certifi>=2026.10.19", "packaging>=24.1", ] dynamic = ["version"]