Skip to content

Update certifi and idna to fix CVEs - #151

Merged
Mark90 merged 1 commit into
mainfrom
fix/certifi-emsign-cve
Oct 21, 2026
Merged

Mark90 merged 1 commit into
mainfrom
fix/certifi-emsign-cve

Conversation

@Mark90

@Mark90 Mark90 commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Security fix

  • certifi → 2026.10.19 (GHSA-6q48-6c7w-9gw2, critical): removes the emSign root CAs whose intermediates had trivially weak private keys. See the python.org announcement.
  • idna 3.10 → 3.20 (medium advisory, fixed in 3.15).

Locked with uv 0.13.4, which no longer trusts the emSign CAs itself.

🤖 Generated with Claude Code

Fixes the critical emSign CA distrust in certifi (GHSA-6q48-6c7w-9gw2) and other open Dependabot alerts in the lockfile.

🤖 Created with help from [Claude Code](https://claude.com/claude-code)
@Mark90 Mark90 added the dependencies Pull requests that update a dependency file label Oct 21, 2026
@github-actions

Copy link
Copy Markdown

uv Lockfile Report

Changed Packages

certifi: 2025.8.3 -> 2026.10.19
idna: 3.10 -> 3.20

@Mark90
Mark90 merged commit 36af9a9 into main Oct 21, 2026
4 of 5 checks passed
@Mark90
Mark90 deleted the fix/certifi-emsign-cve branch October 21, 2026 09:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant