From db376545881216d292b6d9683299adbc30e87d02 Mon Sep 17 00:00:00 2001 From: Marguerite Martinez Date: Tue, 20 Oct 2026 18:16:27 -0400 Subject: [PATCH 1/2] Upgrade certifi to 2026.10.19 certifi 2026.10.19 drops "emSign ECC Root CA - G3", the root that the TLS intermediates exposed in the October 2026 eMudhra/emSign key compromise chain to. Lockfile-only change; no other package moved. Co-Authored-By: Claude Opus 5.5 --- poetry.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/poetry.lock b/poetry.lock index c3e32ba..f36ef6b 100644 --- a/poetry.lock +++ b/poetry.lock @@ -26,14 +26,14 @@ files = [ [[package]] name = "certifi" -version = "2026.7.22" +version = "2026.10.19" description = "Python package for providing Mozilla's CA Bundle." optional = false python-versions = ">=3.7" groups = ["main"] files = [ - {file = "certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775"}, - {file = "certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55"}, + {file = "certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b"}, + {file = "certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae"}, ] [[package]] From 3968986de9a0c0bea00f79c30e1432f9cecf960c Mon Sep 17 00:00:00 2001 From: Marguerite Martinez Date: Wed, 21 Oct 2026 11:43:05 -0400 Subject: [PATCH 2/2] Require certifi >= 2026.10.19 The SDK uses certifi.where() as its default CA bundle, so SDK users trust whatever certifi they have installed. Raising the floor makes upgrading the SDK also pull in the bundle without "emSign ECC Root CA - G3". The template is updated too so regeneration keeps the floor. Co-Authored-By: Claude Opus 5.5 --- poetry.lock | 2 +- pyproject.toml | 2 +- templates/pyproject.mustache | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/poetry.lock b/poetry.lock index f36ef6b..c9d8273 100644 --- a/poetry.lock +++ b/poetry.lock @@ -1034,4 +1034,4 @@ typing-extensions = {version = ">=4.16", markers = "python_version < \"3.11\""} [metadata] lock-version = "2.1" python-versions = "^3.10" -content-hash = "3401c2b71bdcabf72026f964694663a676843dd06f6d2b56088ce745c763db57" +content-hash = "9ff94242adaea25d44f6d54cdf5e28dea87f618b905397c0de5ebddd0234e649" diff --git a/pyproject.toml b/pyproject.toml index 8795fa8..c641262 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -14,7 +14,7 @@ urllib3 = ">= 2.7.0, < 3.0.0" python-dateutil = ">= 2.8.2" pydantic = ">= 2" typing-extensions = ">= 4.7.1" -certifi = ">= 2024.2.2" +certifi = ">= 2026.10.19" [tool.poetry.group.dev.dependencies] pytest = ">= 7.2.1" diff --git a/templates/pyproject.mustache b/templates/pyproject.mustache index 6d6c5b2..7938730 100644 --- a/templates/pyproject.mustache +++ b/templates/pyproject.mustache @@ -25,7 +25,7 @@ pycryptodome = ">= 3.9.0" {{/hasHttpSignatureMethods}} pydantic = ">= 2" typing-extensions = ">= 4.7.1" -certifi = ">= 2024.2.2" +certifi = ">= 2026.10.19" [tool.poetry.group.dev.dependencies] pytest = ">= 7.2.1"