Repository navigation
Conversation
Fixes GHSA-6q48-6c7w-9gw2 (eMudhra emSign ECC Root CA - G3 compromised intermediate keys). Only the certifi entry in Pipfile.lock is changed; version and sha256 hashes taken from PyPI. GHSA-hq85-5cpj-mr62 (uv) does not apply: this repo does not use uv. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Uybqz86W312JcHngTnM126
Author
|
Worth knowing: the tests install with |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
certifi before 2026.10.18 still trusts the eMudhra emSign ECC Root CA - G3, whose intermediate keys were compromised (GHSA-6q48-6c7w-9gw2). 2026.10.18 also dropped some unaffected roots, so this goes to the latest release. It bumps the dev
certifientry inPipfile.lockfrom 2026.1.4 to 2026.10.23. Only that entry changes. The Pipfile does not pin certifi, so_meta.hashstays the same. The related uv advisory (GHSA-hq85-5cpj-mr62) does not apply because this repo does not use uv.Closes Dependabot alert 45.
How it was tested
pipenv is not available in the sandbox, so the lock entry was edited by hand. The version and both sha256 hashes (sdist and wheel) were checked against https://pypi.org/pypi/certifi/2026.10.23/json. CI on this PR runs the full build and tests.
Found in local review
Nothing. The reviewer confirmed that the diff touches only the certifi entry and that the hashes match PyPI.
Not in this PR
The other open Dependabot alerts in this repo (urllib3, requests, idna, pytest, Pygments, zipp in Pipfile.lock). A separate sweep will follow.
Merge
Merge commit, after CI is green.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Uybqz7SRaVuiGbQ8Kv6ZHL