Repository navigation
fix(deps): bump certifi to 2026.10.19 - #216
Merged
Merged
Conversation
certifi 2026.10.19 drops emSign ECC Root CA - G3, which cross-signs eMudhra intermediates whose private keys have been compromised (https://emudhra.we-have-a-problem.com/). requests verifies against certifi's bundle, so until now the app would accept a certificate issued with those keys for any host it calls, such as GitHub's API or Zulip. Only certifi changes in uv.lock. It was locked with uv 0.12.19, the version the production image uses, so the lockfile's format revision stays as it was. Tested in the production image built from this branch: requests rejects the disclosure's test hosts, and still reaches api.github.com. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The private keys of eight eMudhra intermediate CAs have been compromised (https://emudhra.we-have-a-problem.com/). The intermediates chain to emSign ECC Root CA - G3, which is in Mozilla's root store and so in certifi's bundle.
requests, and the Zulip client built on it, verify against that bundle, so the app would accept a certificate issued with those keys for any host it calls, such as GitHub's API or Zulip. The keys' holder would also need to be on the network path to use them.What changes
uv.lock: certifi 2025.8.3 → 2026.10.19, which drops emSign ECC Root CA - G3. Nothing else changes. It was locked with uv 0.12.19, the versionDockerfile.productionuses, so the lockfile's format revision stays at 3. A newer uv would raise it.The image's system store, Debian trixie's
ca-certificates, still trusts the compromised chains until Debian ships its update. Nothing in the app uses it. Its only HTTPS client isrequests, which ignores the system store.Testing
master(certifi 2025.8.3):requestsacceptshttps://dv-g3b-emudhra.we-have-a-problem.com/, one of the disclosure's test hosts.requestsrejects both kinds of test host (dv-g3b-emudhra…, through emSign ECC Root CA - G3, anddv-g3b-aaa-emudhra…, through AAA Certificate Services), and still gets a 200 fromhttps://api.github.com/.uv.lockmatches the certifi 2026.10.19 wheel tested offline against the disclosure's chains.🤖 Generated with Claude Code