Repository navigation
chore(deps): update dependency certifi to v2026.10.18 [security] - #65
renovate[bot] wants to merge 1 commit into
Conversation
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fb09b9e1a0
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| [[package]] | ||
| name = "certifi" | ||
| version = "2026.4.22" | ||
| version = "2026.10.18" |
There was a problem hiding this comment.
For users installing this wrapper through pip, this lock-only change does not apply the security fix: pyproject.toml excludes uv.lock from the sdist and still publishes only posthog and pyyaml requirements, so an environment with certifi 2026.4.22 can retain it. This follows pip's documented install --help default, only-if-needed, which upgrades dependencies only when existing versions no longer satisfy requirements. Add the secure certifi lower bound to the published project dependency metadata, not only the development lockfile.
AGENTS.md reference: AGENTS.md:L7-L10
Useful? React with 👍 / 👎.
| [[package]] | ||
| name = "certifi" | ||
| version = "2026.4.22" | ||
| version = "2026.10.18" |
There was a problem hiding this comment.
When a locked environment connects to a legitimate service whose certificate chains to an unaffected emSign root, 2026.10.18 rejects that connection because it removed every emSign root. The advisory included with this commit states that 2026.10.19 restores the unaffected roots and explicitly recommends 2026.10.19 or later, so pinning the temporary 2026.10.18 bundle introduces avoidable TLS failures.
Useful? React with 👍 / 👎.
This PR contains the following updates:
2026.4.22→2026.10.18certifi bundles emSign root CAs with compromised intermediate CA keys
GHSA-6q48-6c7w-9gw2
More information
Details
Certifi versions before 2026.10.18 include the
emSign ECC Root CA - G3root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them.An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include
requests,urllib3andpip, and the Python.org macOS installer.Certifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
certifi/python-certifi (certifi)
v2026.10.18Compare Source
v2026.7.22Compare Source
v2026.6.17Compare Source
v2026.5.20Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.