[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
certifi	2026.7.22 → 2026.10.19

---

certifi bundles emSign root CAs with compromised intermediate CA keys

GHSA-6q48-6c7w-9gw2

More information

Details

Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them.

An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include requests, urllib3 and pip, and the Python.org macOS installer.

Certifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.

Severity

• CVSS Score: 9.1 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2
• https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
• https://emudhra.we-have-a-problem.com
• https://github.com/advisories/GHSA-6q48-6c7w-9gw2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

certifi/python-certifi (certifi)

v2026.10.19

Compare Source

v2026.10.18

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At 12:00 PM, only on Tuesday (0 12 * * 2)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 8350cc25-156f-4279-bd51-be98e4b84aab

Commits

Reviewing files that changed from the base of the PR and between f2ca435 and fc31115.

Files selected for processing: 1

• requirements-dev-py313.txt

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 9 remain after this review.

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the certificate validation package used in the Python 3.13 development environment. This change affects development tooling only; it does not add or change any app features or behavior visible to end users.

The Python 3.13 development requirements lockfile updates certifi from 2026.7.22 to 2026.10.19 and replaces both pinned hashes.

Changes: Python 3.13 Development Lockfile

Layer / File(s)	Summary
Update certifi pin requirements-dev-py313.txt	The lockfile pins certifi to version 2026.10.19 and replaces both package hashes.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: Minimal · up to fc311

The dependency update is consistent with the security remediation and no merge-blocking issue was found.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the certifi security update to version 2026.10.19.
Description check		The description explains the certifi update and the related critical security advisory.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (f2ca435) to head (fc31115).

Additional details and impacted files

@@            Coverage Diff            @@
##            master      #203   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           13        13           
  Lines          371       371           
=========================================
  Hits           371       371           

Flag	Coverage Δ
unit-tests	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.