From d97df0c82b3f7b6525bb7b108ddc154f7f16a2ca Mon Sep 17 00:00:00 2001 From: Esteban Gutierrez Date: Wed, 21 Oct 2026 17:11:36 -0500 Subject: [PATCH] fix: update trust-store pins for the eMudhra CA compromise (#4624) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cargo.lock: webpki-root-certs 1.0.10; webpki-roots 1.0.10 and rustls-webpki 0.103.16 are already current. docs/web-tests/rs/Cargo.lock: rustls-webpki 0.103.16. python/uv.lock: certifi 2026.10.19, the only entry that changes. The root crate drops the root CA whose intermediates were compromised (Mozilla bug 2083449), and rustls-webpki 0.103.16 rejects chains that carry the compromised eMudhra intermediate keys. certifi 2026.10.19 is the release the certifi advisory names as fixed: it drops the same root and keeps the issuer's other roots, so HTTPS connections that chain to them keep working. Relative to the previous 2026.6.17 pin it also adds Telia EC and RSA TLS Root CA v3 and SECOM TLS ECC and RSA Root CA 2024 and drops Atos TrustedRoot 2011. The webpki-root-certs entry is written by hand with the crates.io checksum. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Esteban Gutierrez Co-authored-by: Claude Opus 5.1 --- Cargo.lock | 4 ++-- docs/web-tests/rs/Cargo.lock | 4 ++-- python/uv.lock | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 1d5d05bdf..3b4086203 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -11144,9 +11144,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.7" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] diff --git a/docs/web-tests/rs/Cargo.lock b/docs/web-tests/rs/Cargo.lock index 447bae7f6..6e288950e 100644 --- a/docs/web-tests/rs/Cargo.lock +++ b/docs/web-tests/rs/Cargo.lock @@ -5561,9 +5561,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "ring", "rustls-pki-types", diff --git a/python/uv.lock b/python/uv.lock index ace8b98b9..e808f5f9e 100644 --- a/python/uv.lock +++ b/python/uv.lock @@ -443,11 +443,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.6.17" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/c9/c7/424b75da314c1045981bd9777432fad05a9e0c69daa4ed7e308bbaffe405/certifi-2026.6.17.tar.gz", hash = "sha256:024c88eeec92ca068db80f02b8b07c9cef7b9fe261d1d535abfd5abd6f6af432", size = 134594, upload-time = "2026-06-17T10:31:07.894Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/ef/2f/c5464532e965badff2f4c4c1a3a83f5697f0d7c407ed0cda44aaa99bb451/certifi-2026.6.17-py3-none-any.whl", hash = "sha256:2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db", size = 133289, upload-time = "2026-06-17T10:31:06.348Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]]