[dependabot]

Bumps pypa/cibuildwheel from 4.3.1 to 4.3.4.

Release notes

Sourced from pypa/cibuildwheel's releases.

v4.3.4

• 🔐 Warns when a uv build frontend is selected and the host uv is older than 0.13.4, which still trusts the compromised eMudhra CA roots (#3021)
• 🔐 Uses cibuildwheel's CA bundle for pip on Python 3.9, where pip uses its bundled certifi, which still trusts the compromised eMudhra roots (#3017)
• 🔐 Uses cibuildwheel's CA bundle for pip on GraalPy, where truststore is not supported (#3019)
• 🔐 Uses cibuildwheel's CA bundle in Android, iOS, and Pyodide cross venvs, where pip uses the host's OpenSSL CA file (#3020)
• 🐛 Seeds build's isolated environment with the pinned pip on macOS and Windows, fixing GraalPy 25.0 builds (#3018)
• 💼 Stops Azure cache growth from restoreKeys (#3022)

v4.3.3

• 🔐 Updates manylinux images and pip to fix vulnerability to eMudhra.

v4.3.2

• 🔐 Updates our dependency pins to certifi==2026.10.19, following the eMudhra Intermediate CA Compromise. Linux builds may still be vulnerable through manylinux images - a patch release will soon follow if so.

Changelog

Sourced from pypa/cibuildwheel's changelog.

---

title: Changelog ref: changelog

Changelog

v4.3.5

27 October 2026

• 🐛 Stops passing the target build environment to the host virtualenv call, regression in v4.3.4 (#3023)
• 🛠 Updates dependencies and constraints (pyodide-build 0.39.3, CPython 3.15.2, etc) (#3024, #3027)
• 💼 Updates CI actions (#3025)

v4.3.4

22 October 2026

• 🔐 Warns when a uv build frontend is selected and the host uv is older than 0.13.4, which still trusts the compromised eMudhra CA roots (#3021)
• 🔐 Uses cibuildwheel's CA bundle for pip on Python 3.9, where pip uses its bundled certifi, which still trusts the compromised eMudhra roots (#3017)
• 🔐 Uses cibuildwheel's CA bundle for pip on GraalPy, where truststore is not supported (#3019)
• 🔐 Uses cibuildwheel's CA bundle in Android, iOS, and Pyodide cross venvs, where pip uses the host's OpenSSL CA file (#3020)
• 🐛 Seeds build's isolated environment with the pinned pip on macOS and Windows, fixing GraalPy 25.0 builds (#3018)
• 💼 Stops Azure cache growth from restoreKeys (#3022)

v4.3.3

21 October 2026

• 🔐 Updates manylinux images and pip to fix vulnerability to eMudhra.

v4.3.2

20 October 2026

• 🔐 Updates our dependency pins to certifi==2026.10.19, following the eMudhra Intermediate CA Compromise. Linux builds may still be vulnerable through manylinux images - a patch release will soon follow if so.

v4.3.1

10 October 2026

• 🛠 Updates CPython 3.15 to the final 3.15.0 release (#3009)

v4.3.0

5 October 2026

• ✨ Extends option inheritance to every configuration layer, so global and platform-specific settings can append or prepend to existing values, including cibuildwheel's defaults. Environment variables can also extend earlier settings using CIBW_INHERIT. (#2928)
• ✨ Adds PyPy 3.12 support and updates PyPy 3.11 to v8.0.0, available with the pypy enable flag (#2998)

... (truncated)

Commits

• b9e566a Bump version: v4.3.4
• 0d511ac fix: use cibuildwheel's CA bundle in cross venvs (#3020)
• d6c9b11 feat: warn when uv is too old to have the eMudhra CA fix (#3021)
• 4463120 fix: seed build's isolated env with the pinned pip (#3018)
• 6d4911a fix: use cibuildwheel's CA bundle for pip on GraalPy (#3019)
• 54d1a6f ci: stop Azure cache growth from restoreKeys (#3022)
• 5891574 fix: use cibuildwheel's CA bundle for pip on Python 3.9 (#3017)
• 8c2dcd2 Bump version: v4.3.3
• 56459e6 [Bot] Update dependencies (#3012)
• afd09e6 chore(deps): bump the actions group with 4 updates (#3013)
• Additional commits viewable in compare view

[manthey]

@dependabot rebase