[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
certifi	2026.7.22 → 2026.10.19

---

certifi bundles emSign root CAs with compromised intermediate CA keys

GHSA-6q48-6c7w-9gw2

More information

Details

Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them.

An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include requests, urllib3 and pip, and the Python.org macOS installer.

Certifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.

Severity

• CVSS Score: 9.1 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2
• https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
• https://emudhra.we-have-a-problem.com
• https://github.com/advisories/GHSA-6q48-6c7w-9gw2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

certifi/python-certifi (certifi)

v2026.10.19

Compare Source

v2026.10.18

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Summary by CodeRabbit

• Chores
  • Updated the certificate trust package to a newer pinned release and refreshed its verification hashes. No user-facing features or behavior changes are included.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 69a94d84-76c4-436a-84ef-206a132246ad

Commits

Reviewing files that changed from the base of the PR and between 03562ef and f7046dd.

Files selected for processing: 1

• requirements.txt

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

requirements.txt updates the pinned certifi version from 2026.7.22 to 2026.10.19 and replaces its two allowed hashes.

Changes: Certifi dependency update

Layer / File(s)	Summary
Update certifi pin requirements.txt	The pinned certifi version changes to 2026.10.19. Both allowed hashes are replaced.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Possibly related issues

• GortexAI/franco#5 — The issue lists the certifi update to 2026.10.19 included in this change.

Possibly related PRs

• GortexAI/franco#37 — This PR changes the same certifi pin and replaces the package hashes.

Suggested reviewers: heminjoshi

Merge Risk: Minimal · up to f7046

The dependency update is correctly pinned and presents no identified merge-blocking risk.

Architecture risk: Low · up to f7046

The change affects 1 system.

Changed systems: requirements.txt

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — requirements.txt (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in requirements.txt: The pinned certifi release changes from 2026.7.22 to 2026.10.19, with both package hashes replaced.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description accurately explains the certifi update and its security purpose, but it does not follow the repository template. It omits the "What and why" heading, testing details, and the required …	Add the required template sections. State what changed and why, describe how the update was tested, and complete the checklist, including pytest results and confirmation that sending safety and repository data protections are unchanged or e…

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly identifies the primary change: a security update of the certifi dependency to version 2026.10.19.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Description check

Explanation

The description accurately explains the certifi update and its security purpose, but it does not follow the repository template. It omits the "What and why" heading, testing details, and the required checklist.

Resolution

Add the required template sections. State what changed and why, describe how the update was tested, and complete the checklist, including pytest results and confirmation that sending safety and repository data protections are unchanged or explain any changes.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}