You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by po...@apache.org on 2026/10/21 11:48:54 UTC
(airflow) branch main updated: Bump certifi to 2026.10.19 to drop the compromised emSign ECC Root CA - G3 (#75302)
This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 7e0c1acb426 Bump certifi to 2026.10.19 to drop the compromised emSign ECC Root CA - G3 (#75302)
7e0c1acb426 is described below
commit 7e0c1acb426a6b7900f9206049cbc8bce4c37277
Author: Kaxil Naik <ka...@apache.org>
AuthorDate: Wed Oct 21 12:48:45 2026 +0100
Bump certifi to 2026.10.19 to drop the compromised emSign ECC Root CA - G3 (#75302)
certifi 2026.10.19 removes the emSign ECC Root CA - G3 root after the eMudhra CA compromise. It is inside the 4-day exclude-newer window, so add a temporary per-package cutoff to both [tool.uv.exclude-newer-package] and [tool.uv.pip.exclude-newer-package], following #75296, and relock certifi.
---
pyproject.toml | 6 ++++++
uv.lock | 7 ++++---
2 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/pyproject.toml b/pyproject.toml
index 4252aa0efeb..1e7f75cd38f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1647,6 +1647,10 @@ google-cloud-aiplatform = "2026-08-13T00:00:00Z"
pip = false
uv = false
+# certifi 2026.10.19 removes the compromised "emSign ECC Root CA - G3" root. Remove this
+# `exclude-newer-package` after 2026-10-25, when that release has been out for 4 days.
+certifi = "2026-10-21T00:00:00Z"
+
[tool.airflow.dependency-floors]
# Floors of these dependencies are raised by `breeze ci upgrade` (scripts/ci/prek/upgrade_dependency_floors.py),
# see dev/breeze/doc/adr/0018-raise-dependency-floors-automatically.md.
@@ -1834,6 +1838,8 @@ google-cloud-aiplatform = "2026-08-13T00:00:00Z"
# Package managers bypass the cooldown — see `[tool.uv.exclude-newer-package]`.
pip = false
uv = false
+# Temporary: see the certifi note in `[tool.uv.exclude-newer-package]`.
+certifi = "2026-10-21T00:00:00Z"
[tool.uv.sources]
# These names must match the names as defined in the pyproject.toml of the workspace items,
diff --git a/uv.lock b/uv.lock
index 8889d50fc2d..367162ce1b6 100644
--- a/uv.lock
+++ b/uv.lock
@@ -171,6 +171,7 @@ apache-airflow-shared-template-rendering = false
apache-airflow-shared-timezones = false
apache-airflow-task-sdk = false
apache-airflow-task-sdk-integration-tests = false
+certifi = "2026-10-21T00:00:00Z"
google-cloud-aiplatform = "2026-08-13T00:00:00Z"
pip = false
uv = false
@@ -11169,11 +11170,11 @@ redis = [
[[package]]
name = "certifi"
-version = "2026.7.22"
+version = "2026.10.19"
source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" }
wheels = [
- { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" },
+ { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" },
]
[[package]]