From a558f815e5752db443dc836587ae0f4c9c1a63d6 Mon Sep 17 00:00:00 2001 From: Lawrence Elitzer Date: Tue, 20 Oct 2026 14:22:23 -0500 Subject: [PATCH 1/2] fix(deps): bump certifi to 2026.10.19 certifi 2026.10.19 removes the emSign ECC Root CA - G3 root after eight eMudhra intermediate CA private keys were compromised (https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html). requests and httpx trust certifi's bundle and do not check revocation. Bump the locked certifi and release 0.46.6. The certifi requirement for installs is unchanged. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 5 +++++ src/unstructured_client/_version.py | 4 ++-- uv.lock | 6 +++--- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bc3c86d5..d43e0254 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,8 @@ +## 0.46.6 + +### Fixes +* Bump locked `certifi` to 2026.10.19, which removes the emSign ECC Root CA - G3 root after eight eMudhra intermediate CA private keys were compromised. `requests` and `httpx` trust certifi's bundle and do not check revocation, so with the older bundle they accepted certificates chaining to that root. Only the lockfile changes; the `certifi` requirement for installs is unchanged, so upgrade `certifi` in your own environment. + ## 0.46.5 ### Fixes diff --git a/src/unstructured_client/_version.py b/src/unstructured_client/_version.py index 14f08645..5ab1a8bd 100644 --- a/src/unstructured_client/_version.py +++ b/src/unstructured_client/_version.py @@ -3,10 +3,10 @@ import importlib.metadata __title__: str = "unstructured-client" -__version__: str = "0.46.5" +__version__: str = "0.46.6" __openapi_doc_version__: str = "1.2.31" __gen_version__: str = "2.680.0" -__user_agent__: str = "speakeasy-sdk/python 0.46.5 2.680.0 1.2.31 unstructured-client" +__user_agent__: str = "speakeasy-sdk/python 0.46.6 2.680.0 1.2.31 unstructured-client" try: if __package__ is not None: diff --git a/uv.lock b/uv.lock index 49f3508e..8e433a6e 100644 --- a/uv.lock +++ b/uv.lock @@ -48,11 +48,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.2.25" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/af/2d/7bf41579a8986e348fa033a31cdd0e4121114f6bce2457e8876010b092dd/certifi-2026.2.25.tar.gz", hash = "sha256:e887ab5cee78ea814d3472169153c2d12cd43b14bd03329a39a9c6e2e80bfba7", size = 155029, upload-time = "2026-02-25T02:54:17.342Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/9a/3c/c17fb3ca2d9c3acff52e30b309f538586f9f5b9c9cf454f3845fc9af4881/certifi-2026.2.25-py3-none-any.whl", hash = "sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa", size = 153684, upload-time = "2026-02-25T02:54:15.766Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] From e64fef9a8a81cb9f76f12e82a07375571e4ad622 Mon Sep 17 00:00:00 2001 From: Lawrence Elitzer Date: Tue, 20 Oct 2026 15:51:20 -0500 Subject: [PATCH 2/2] fix(deps): require certifi>=2026.10.19 certifi 2026.10.19 drops the emSign ECC Root CA - G3 root after the eMudhra intermediate CA key compromise. Require it as a direct dependency so pip installs get the new bundle too. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 2 +- gen.yaml | 1 + pyproject.toml | 1 + uv.lock | 2 ++ 4 files changed, 5 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d43e0254..98cb8e57 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,7 +1,7 @@ ## 0.46.6 ### Fixes -* Bump locked `certifi` to 2026.10.19, which removes the emSign ECC Root CA - G3 root after eight eMudhra intermediate CA private keys were compromised. `requests` and `httpx` trust certifi's bundle and do not check revocation, so with the older bundle they accepted certificates chaining to that root. Only the lockfile changes; the `certifi` requirement for installs is unchanged, so upgrade `certifi` in your own environment. +* Bump locked `certifi` to 2026.10.19, which removes the emSign ECC Root CA - G3 root after eight eMudhra intermediate CA private keys were compromised. `requests` and `httpx` trust certifi's bundle and do not check revocation, so with the older bundle they accepted certificates chaining to that root. `certifi` is now also a direct dependency at `>=2026.10.19`, so pip installs pick up the new bundle too. ## 0.46.5 diff --git a/gen.yaml b/gen.yaml index 966a3a8d..ca23d340 100644 --- a/gen.yaml +++ b/gen.yaml @@ -41,6 +41,7 @@ python: uvloop: '>=0.22.1' main: aiofiles: '>=25.1.0' + certifi: '>=2026.10.19' httpx: '>=0.28.1' pypdf: '>=6.9.2' pypdfium2: '>=5.6.0' diff --git a/pyproject.toml b/pyproject.toml index 5c15a727..fae4afa7 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -7,6 +7,7 @@ readme = "README-PYPI.md" requires-python = ">=3.11" dependencies = [ "aiofiles >=25.1.0", + "certifi >=2026.10.19", "httpcore >=1.0.9", "httpx >=0.28.1", "pydantic >=2.12.5", diff --git a/uv.lock b/uv.lock index 8e433a6e..2d1ddf3b 100644 --- a/uv.lock +++ b/uv.lock @@ -781,6 +781,7 @@ name = "unstructured-client" source = { editable = "." } dependencies = [ { name = "aiofiles" }, + { name = "certifi" }, { name = "httpcore" }, { name = "httpx" }, { name = "pydantic" }, @@ -807,6 +808,7 @@ dev = [ [package.metadata] requires-dist = [ { name = "aiofiles", specifier = ">=25.1.0" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "httpcore", specifier = ">=1.0.9" }, { name = "httpx", specifier = ">=0.28.1" }, { name = "pydantic", specifier = ">=2.12.5" },