You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(security): bump certifi to 2026.10.19 (CVE-2026-111943) - #474
Bumps certifi to 2026.10.19 in response to CVE-2026-111943 (eMudhra/emSign intermediate CA compromise). certifi 2026.10.19 removes the emSign root from the CA bundle used by requests/httpx/urllib3/aiohttp.
Changes (old -> new)
poetry.lock: certifi 2025.4.26 -> 2026.10.19
Only the certifi entry was changed (version, python-versions, and both file hashes, verified against PyPI). No other packages were touched. poetry update certifi --lock with a newer Poetry also rewrote some unrelated formatting, so only the certifi entry was kept.
No pip or uv pins are present in the repo, so none were changed.
Notes
The fix applies once the package or images are rebuilt and redeployed. Images should also pick up the updated OS ca-certificates.
Note
Low Risk
Single transitive dependency bump in the lockfile for a known CA-bundle CVE; no app logic changes, though TLS trust behavior updates after rebuild/redeploy.
Overview
Updates the locked certifi dependency in poetry.lock from 2025.4.26 to 2026.10.19 to address CVE-2026-111943 (compromised eMudhra/emSign intermediate CA). The new bundle drops the affected emSign root, which flows through to TLS clients that use this lockfile (e.g. requests, httpx).
Only the certifi lock entry changes (version, minimum Python version, and wheel/sdist hashes). No application code or other packages are modified.
Reviewed by Cursor Bugbot for commit 8575104. Bugbot is set up for automated code reviews on this repo. Configure here.
Pin black to a patched version once available (e.g., poetry add black@latest --group dev) or, as a workaround, remove/upgrade black and run the formatter only in an isolated, untrusted-input-free CI environment; monitor PYSEC-2026-2120, PYSEC-2026-2121, and GHSA-3936-cmfr-pm3m for fixed releases.
Upgrade to the latest transformers release that addresses the individual advisories (e.g., poetry add transformers@latest or poetry update transformers), and since no single fixed version covers all 15 advisories, review each advisory individually and pin to the newest available version while monitoring for patched releases; as an interim mitigation, avoid loading untrusted models/checkpoints and disable unsafe deserialization paths.
Upgrade to the latest available Pillow release (e.g., poetry add pillow@latest or poetry update pillow) and monitor for patched releases addressing GHSA-8g5g-8vmr-9782; as an interim workaround, restrict or sandbox processing of untrusted image inputs.
Dismiss false positives
Tick a box to dismiss the finding; untick it to bring the finding back. That is the same as replying /broly dismiss d1 and /broly undismiss d1. To record why it is a false positive, reply with /broly dismiss d1: your reason instead — Broly reuses those reasons to triage similar findings across the org.
We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps
certifito 2026.10.19 in response to CVE-2026-111943 (eMudhra/emSign intermediate CA compromise). certifi 2026.10.19 removes the emSign root from the CA bundle used by requests/httpx/urllib3/aiohttp.Changes (old -> new)
poetry.lock: certifi2025.4.26->2026.10.19Only the certifi entry was changed (version,
python-versions, and both file hashes, verified against PyPI). No other packages were touched.poetry update certifi --lockwith a newer Poetry also rewrote some unrelated formatting, so only the certifi entry was kept.No pip or uv pins are present in the repo, so none were changed.
Notes
The fix applies once the package or images are rebuilt and redeployed. Images should also pick up the updated OS
ca-certificates.Note
Low Risk
Single transitive dependency bump in the lockfile for a known CA-bundle CVE; no app logic changes, though TLS trust behavior updates after rebuild/redeploy.
Overview
Updates the locked
certifidependency inpoetry.lockfrom 2025.4.26 to 2026.10.19 to address CVE-2026-111943 (compromised eMudhra/emSign intermediate CA). The new bundle drops the affected emSign root, which flows through to TLS clients that use this lockfile (e.g. requests, httpx).Only the
certifilock entry changes (version, minimum Python version, and wheel/sdist hashes). No application code or other packages are modified.Reviewed by Cursor Bugbot for commit 8575104. Bugbot is set up for automated code reviews on this repo. Configure here.