[Pablo (pablo-airbyte)]

Summary

TL;DR: Require an updated Python certificate bundle for CDK consumers after the eMudhra CA incident. Add certifi>=2026.10.23 and update its entry in poetry.lock. No Dockerfile or base-image changes are included.

Related connector-image patch: airbytehq/airbyte#90276. Its Python connector build override does not run in the CDK-owned images, which install from this repository's dependencies.

Changes

• Set a direct certifi dependency floor so CDK dependency installation cannot restore the previous 2024.12.14 Python bundle.
• Update only certifi in the lockfile and exempt this intentional transitive security constraint from the unused-dependency check.

Test plan

• poetry check passed, with existing metadata deprecation warnings.
• poetry run ruff check . and poetry run ruff format --check . passed.
• poetry run mypy --config-file mypy.ini airbyte_cdk passed for 477 source files after installing local types-pytz stubs.
• poetry run pytest unit_tests/sources/streams/http/test_http_client.py unit_tests/sources/declarative/requesters/test_http_requester.py unit_tests/manifest_server -q: 233 passed with the manifest-server extra installed.
• Pre-commit passed using a local node: system override to work around Node version-discovery failure; repository hook configuration was not changed.
• Verified installed certifi 2026.10.23 omits emSign ECC Root CA - G3; openssl verify rejects that root using the Python CA bundle.

Risks and scope

Endpoints relying exclusively on distrusted roots will fail Python TLS validation, as intended. CVE-2026-91403 tracks Java; this PR covers the Python certificate-bundle side of the same CA incident. It does not refresh operating-system trust stores or remediate running images by itself.

CI limitation

25 checks passed, including the Python 3.11–3.14 test matrix, lint/type checks, package build, and both Docker image builds. The only failure is the MotherDuck connector check: its shared test credential has no enabled secret version. It stops during credential fetch, before the connector switches to this CDK revision. The same credential failure occurred earlier on another branch.

A CI owner must restore the shared test credential and rerun that check. Rerunning failed jobs from this session was rejected with Resource not accessible by integration.

Follow-ups

• After the platform team publishes a patched python-connector-base, update the CDK shared runtime's base version and digest in a separate change. The manifest server uses a separate upstream Python base and needs its own system-trust-store update.
• Publish a CDK release and runtime images, roll them out, and verify deployed trust stores. The base-image work is separate from this dependency-floor PR.

Requested by Pablo (@pablo-airbyte).

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This CDK Version

You can test this version of the CDK using the following:

# Run the CLI from this branch:
uvx 'git+https://github.com/airbytehq/airbyte-python-cdk.git@devin/1793914121-cdk-emudhra-ca#egg=airbyte-python-cdk[dev]' --help

# Update a connector to use the CDK from this branch ref:
cd airbyte-integrations/connectors/source-example
poe use-cdk-branch devin/1793914121-cdk-emudhra-ca

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

• /autofix - Fixes most formatting and linting issues
• /poetry-lock - Updates poetry.lock file
• /test - Runs connector tests with the updated CDK
• /prerelease - Triggers a prerelease publish with default arguments
• /poe build - Regenerate git-committed build artifacts, such as the pydantic models which are generated from the manifest JSON schema in YAML.
• /poe <command> - Runs any poe command in the CDK environment

📚 Show Repo Guidance

Helpful Resources

• CDK API Reference

📝 Edit this welcome message.

[github-actions]

PyTest Results (Fast)

6 434 tests  ±0   6 397 ✅  - 1   7m 25s ⏱️ +33s
    1 suites ±0      37 💤 +1 
    1 files   ±0       0 ❌ ±0 

Results for commit 03dff58. ± Comparison against base commit a0d630a.

This pull request skips 1 test.

unit_tests.sources.declarative.test_concurrent_declarative_source ‑ test_read_with_concurrent_and_synchronous_streams

♻️ This comment has been updated with latest results.

[github-actions]

PyTest Results (Full)

6 437 tests  ±0   6 400 ✅  - 1   10m 11s ⏱️ + 2m 1s
    1 suites ±0      37 💤 +1 
    1 files   ±0       0 ❌ ±0 

Results for commit 03dff58. ± Comparison against base commit a0d630a.

This pull request skips 1 test.

unit_tests.sources.declarative.test_concurrent_declarative_source ‑ test_read_with_concurrent_and_synchronous_streams

♻️ This comment has been updated with latest results.

[Kaizer (kaizerch)]

Looked through this one, Pablo (@pablo-airbyte). LGTM, nothing blocking. A few notes from checking the bundle itself rather than the diff:

• Confirmed the lock hashes match PyPI for 2026.10.23 (still the latest certifi) and poetry check --lock is clean at the head commit.
• Diffed the two bundles. 2024.12.14 → 2026.10.23 drops 43 roots and adds 12. Three are emSign (ECC G3, ECC C3, C1; G1 stays, matching Mozilla's call). The other 40 are Mozilla's April 2026 lifecycle removals: DigiCert's G1 roots, GTS Root R2, Entrust G2/EC1, COMODO, Baltimore CyberTrust, GlobalSign Root CA, Go Daddy and Starfield Class 2, and so on. Since the SDM lock has sat on 2024.12.14, this is the first time manifest-only connectors cross that line.
• Ran a TLS handshake against 149 common connector API hosts with both bundles: zero regressions. So I'd expect the impact to be small.