Repository navigation
2026.10.23 - #445
Merged
Merged
2026.10.23#445
Conversation
This was referenced Oct 23, 2026
tony
added a commit
to cihai/cihai
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx), per `uv tree --frozen --invert --package certifi`. The relock moved nothing else. certifi 2026.10.23 (2026-10-23) is not taken in this sweep; it is still inside the 3-day cooldown. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - certifi/python-certifi#445
tony
added a commit
to cihai/unihan-db
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx). The relock moved nothing else. 2026.10.23 is not taken in this sweep: it is still inside the cooldown. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - certifi/python-certifi#445
tony
added a commit
to vcs-python/libvcs
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx via gp-sphinx), per `uv tree --frozen --invert --package certifi`. The relock moved nothing else. A newer 2026.10.23 (published 2026-10-23T11:36Z) is still inside the cooldown and is not taken in this sweep. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - certifi/python-certifi#445 - https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3
This was referenced Oct 26, 2026
rparke
added a commit
to alphagov/notifications-api
that referenced
this pull request
Oct 26, 2026
Removes weak eMudhra certificate per certifi/python-certifi#445
|
@alex Does this change the minimum fixed version in the advisory? Is 2026.10.18 safer than 2026.10.19 and as safe as 2026.10.23? (btw the advisory has a typo in cerificate) |
Member
|
This has no impact on the minimum fixed version. |
jonty-uk-gov-mirror
pushed a commit
to uk-gov-mirror/alphagov.notifications-antivirus
that referenced
this pull request
Oct 26, 2026
shrey-berri
added a commit
to BerriAI/litellm
that referenced
this pull request
Oct 27, 2026
certifi 2026.10.23 drops emSign Root CA - C1 and emSign ECC Root CA - C3 (certifi/python-certifi#445), so the default outbound TLS trust now matches the roots grpcio 1.84.1 and webpki-roots 1.0.11 already use. - raise the certifi floor to >=2026.10.23 in pyproject.toml, packaging/litellm-core/pyproject.toml and liccheck.ini - lock certifi 2026.10.23 in uv.lock (no other package changes) - remove the expired GHSA-6q48-6c7w-9gw2 osv-scanner ignore; the advisory was fixed in 2026.10.18 - test that the default SSL context no longer trusts emSign C1 or C3, and stop two SSL tests from leaking a fake context into the shared cache Follow-up to #47969.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated changes by create-pull-request GitHub action