Repository navigation
Remove emsign - #437
Merged
Merged
Remove emsign#437
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
4 tasks done
|
Sorry, is there a CVE or something incoming that explains this? |
Closed
See #439 and https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ?pli=1 |
3 tasks done
7 of 9 tasks
ohemorange
pushed a commit
to certbot/certbot
that referenced
this pull request
Oct 21, 2026
certifi 2026.10.19 removes the emSign roots after the eMudhra intermediate CA compromise (certifi/python-certifi#437, #440). The pin in `tools/requirements.txt` is still on 2026.7.22, which trusts those roots. Since `tools/pip_install.py` uses this file as the pip constraint, the published `certbot/certbot` and `certbot/dns-*` Docker images ship the old bundle, and ACME requests made through `requests` still accept chains issued by the compromised intermediates. This only bumps the certifi line. Happy to run a full repin with `tools/pinning/current/repin.sh` instead if you prefer. How to check: inside the current `certbot/certbot:latest` image, `python -c "import certifi; print(certifi.__version__)"` prints 2026.07.22, and a TLS connection to `dv-g3b-emudhra.we-have-a-problem.com` (a test site served by one of the affected intermediates) verifies against `certifi.where()`.
This was referenced Oct 22, 2026
This was referenced Oct 23, 2026
Merged
tony
added a commit
to git-pull/gp-sphinx
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests, which codecov and Sphinx both depend on (`uv tree --frozen --invert --package certifi`). 2026.10.23 (published 2026-10-23T11:36Z) is not taken in this sweep. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19. The relock moved nothing else. See also: - certifi/python-certifi#437 - certifi/python-certifi#440
tony
added a commit
to tony/rampa
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests and Sphinx (`uv tree --frozen --invert --package certifi`). The relock moved nothing else. 2026.10.23 is not taken in this sweep: it was published 2026-10-23T11:36Z and stays inside the cooldown until 2026-10-26. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440
tony
added a commit
to tony/django-search-query
that referenced
this pull request
Oct 24, 2026
why: certifi 2026.7.22 is flagged critical by Dependabot in sibling repos. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. 2026.10.23 (published 2026-10-23T11:36Z) stays excluded by the cooldown until 2026-10-26. `uv tree --frozen --invert --package certifi` shows certifi reaching the dev group only, through requests, which codecov and Sphinx (via gp-sphinx) depend on. The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440
tony
added a commit
to tony/learning-litestar
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the [standard] extra through litestar -> httpx -> httpcore and httpx (`uv tree --frozen --invert --package certifi`). The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19; no other package moved See also: - certifi/python-certifi#437 - certifi/python-certifi#440
tony
added a commit
to tony/django-slugify-processor
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx). The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440
tony
added a commit
to tony/agentgrep
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (Sphinx and its docs extensions); requests is its only dependent in uv.lock. A newer certifi 2026.10.23 (published 2026-10-23T11:36Z) is not taken in this sweep: it is inside the 3-day cooldown until 2026-10-26. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19; no other package moved See also: - certifi/python-certifi#437 - certifi/python-certifi#440
tony
added a commit
to tmux-python/libtmux
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. A newer 2026.10.23 (published 2026-10-23T11:36Z) is still inside the cooldown and is not taken here. certifi reaches the dev group through requests (`uv tree --frozen --invert --package certifi`: codecov, and Sphinx via gp-sphinx). The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440
tony
added a commit
to tmux-python/libtmux-mcp
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, and Sphinx via the docs tooling); `uv tree --frozen --invert --package certifi` shows no other parent. The relock moved nothing else. 2026.10.23 (2026-10-23) is still inside the cooldown until 2026-10-26 and is not taken here. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3
tony
added a commit
to tony/learning-ai-langchain
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the runtime through httpx, httpcore, langchain-openai and requests (`uv tree --frozen --invert --package certifi`). The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3
tony
added a commit
to tony/learning-ai-google-adk
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches this repo through httpx/httpcore (google-adk, google-genai, litestar and the dev group) and through requests (google-adk, google-genai, google-auth), per `uv tree --frozen --invert --package certifi`. 2026.10.23 (published 2026-10-23T11:36Z) is inside the cooldown and is not taken. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 - uv.lock: authlib 1.9.0 -> 1.9.1 moved with it. The lock was stale against the editable google-adk source, whose metadata now requires authlib>=1.9.1, so the relock re-read that metadata (authlib floor, opentelemetry-api cap <=1.44, litellm cap <1.106.3, reshuffled otel extras) and no other package version moved. See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3
tony
added a commit
to cihai/cihai
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx), per `uv tree --frozen --invert --package certifi`. The relock moved nothing else. certifi 2026.10.23 (2026-10-23) is not taken in this sweep; it is still inside the 3-day cooldown. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - certifi/python-certifi#445
tony
added a commit
to tony/pytest-pgsnap
that referenced
this pull request
Oct 24, 2026
why: certifi 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones, so 2026.10.19 is the first patched release and is past the three-day cooldown. 2026.10.23 (published 2026-10-23T11:36Z) is still inside the cooldown and is not taken. certifi reaches the dev and docs groups through requests (codecov, Sphinx). The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440
tony
added a commit
to cihai/unihan-db
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx). The relock moved nothing else. 2026.10.23 is not taken in this sweep: it is still inside the cooldown. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - certifi/python-certifi#445
tony
added a commit
to vcs-python/g
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx). The relock moved nothing else. A newer 2026.10.23 exists but is still inside the cooldown, so it is not taken here. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440
tony
added a commit
to tony/django-docutils
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx), per `uv tree --frozen --invert --package certifi`. The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3
tony
added a commit
to tony/learning-fastapi
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through httpx and httpcore (`uv tree --frozen --invert --package certifi`). 2026.10.23 (2026-10-23) stays excluded by the cooldown until 2026-10-26. The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19; no other package moved See also: - certifi/python-certifi#437 - certifi/python-certifi#440
tony
added a commit
to cihai/cihai-cli
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov and Sphinx). The relock moved nothing else. what: - uv.lock: certifi only. `uv tree --frozen --invert --package certifi` shows requests as the only parent; the lock diff lists no other package. See also: - certifi/python-certifi#437 - certifi/python-certifi#440
tony
added a commit
to cihai/unihan-etl
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx). The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440
tony
added a commit
to git-pull/gp-libs
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx via gp-sphinx). The relock moved nothing else. 2026.10.23 is not taken in this sweep. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440
tony
added a commit
to vcs-python/libvcs
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx via gp-sphinx), per `uv tree --frozen --invert --package certifi`. The relock moved nothing else. A newer 2026.10.23 (published 2026-10-23T11:36Z) is still inside the cooldown and is not taken in this sweep. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440 - certifi/python-certifi#445 - https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3
tony
added a commit
to vcs-python/vcspull
that referenced
this pull request
Oct 24, 2026
why: Dependabot flags certifi 2026.7.22 as critical. 2026.10.18 removed the emSign roots after the eMudhra CA incident and 2026.10.19 restored the unaffected ones; 2026.10.19 is the first patched release and is past the three-day cooldown. certifi reaches the dev group through requests (codecov, Sphinx). A newer 2026.10.23 (published 2026-10-23T11:36Z) is still inside the cooldown and is not taken here. The relock moved nothing else. what: - uv.lock: certifi 2026.7.22 -> 2026.10.19 See also: - certifi/python-certifi#437 - certifi/python-certifi#440
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.