Repository navigation
fix(deps): move certifi to 2026.10.23 and grpcio to 1.84.1 - #3438
Conversation
This comment has been minimized.
This comment has been minimized.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Dependency version requirements pyproject.toml, docs/getting-started/installation.md |
The base dependencies require certifi>=2026.10.23. The semantic and milvus extras require grpcio>=1.84.1. The installation guide lists certifi as providing Mozilla’s CA Bundle. |
Dependency and lockfile checks codebase_rag/tests/test_build_tls_trust.py |
New tests check that dependency ranges include the required floors and exclude the last stale versions. They also check that uv.lock has exact versions at or above the floors and reject missing or stale entries. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Possibly related PRs
- vitali87/code-graph-rag#3435: Both PRs address TLS trust changes; this PR updates the
certifiandgrpciobundles, while the related PR updates system certificate stores used by pip and build workflows. - vitali87/code-graph-rag#3439: Both PRs address distrust of eMudhra roots; this PR updates
certifiandgrpciobundles, while the related PR updates system CA stores.
Suggested reviewers: claude
Merge Risk: 
bd303
-
The dependency floors and lockfile checks are consistent with the stated update; the change is ready for normal merge checks.
Pre-merge checks: 
-
Check name Status Explanation Title check The title "fix(deps): move certifi to 2026.10.23 and grpcio to 1.84.1" names the main change: bumping the locked certifi and grpcio versions to fixed releases. It follows Conventional Commits and matc… Description check The description follows the template. It has a Summary that explains the two version bumps and why they matter (stale emSign roots in certifi and grpcio's bundled roots.pem), and it explains why the f… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title "fix(deps): move certifi to 2026.10.23 and grpcio to 1.84.1" names the main change: bumping the locked certifi and grpcio versions to fixed releases. It follows Conventional Commits and matches the raw summary, which covers the pyproject.toml floors, the test file, and the docs line. The title does not mention the new tests or the declared floors, which is acceptable because it need not cover every detail.
Full details: Description check
-
Explanation
The description follows the template. It has a Summary that explains the two version bumps and why they matter (stale emSign roots in certifi and grpcio's bundled roots.pem), and it explains why the floors are also declared in pyproject.toml. It lists tests and verification steps. The Demo section is missing. Its template text asks for a demo or a one-line 'No user-visible change' statement, and the author did not fill it in. The Type of Change checkboxes are unchecked, and the Related Issues section is empty. The Test Plan does not check any box. The Checklist is unchecked. These gaps are mostly administrative. The substance is complete.
-
Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
 [Medium impact] The PR appears safe to merge; no blocking issue was found. SummaryUpdates
Reviews (1) · Last reviewed commit: "fix(deps): move certifi to 2026.10.23 an..." · Reviewed by Greptile |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 212c2abcae
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
A published wheel carries pyproject's ranges, not uv.lock, and pip upgrades a dependency only when the installed one no longer satisfies them, so an upgrade of code-graph-rag over an older environment kept certifi 2026.10.19 or grpcio 1.84.0. certifi>=2026.10.23 joins the core dependencies and grpcio>=1.84.1 the semantic and milvus extras, whose gRPC clients trust grpcio's own roots.pem. The test now checks the declared ranges as well as the lock.
|
Summary
Two locked packages carry their own copy of the roots:
roots.pemstill has emSign ECC Root CA - G3grpcio's default channel credentials load its bundled
roots.pem, not certifi and not the system store. So the Qdrant and Milvus gRPC clients trusted G3 whatever else was fixed. Only these two package versions change inuv.lock.A published wheel carries
pyproject.toml's ranges, notuv.lock, and pip upgrades a dependency only when the installed one no longer satisfies them. So the floors are also declared:certifi>=2026.10.23in the core dependencies, andgrpcio>=1.84.1in thesemanticandmilvusextras.Tests
test_the_lock_is_past_every_bundled_root_fix: every locked certifi must be at or above 2026.10.23, and every locked grpcio at or above 1.84.1.test_a_lock_with_a_stale_root_bundle_is_rejected: an old certifi, an old grpcio, and certifi not locked at all.test_pyproject_declares_every_bundled_root_floor: each declared range must admit the fixed release and refuse the last stale one (certifi 2026.10.19, grpcio 1.84.0).test_a_declared_range_that_admits_a_stale_bundle_is_rejected: no certifi, a stale certifi floor, an extra without grpcio, a stale grpcio floor, and a barecertifi.Red, then green: with the checker stubbed, the negative cases failed. With the real checker and the old lock, the repository check failed. After the bump, everything passes. Reverting either version on its own turns that test red.
Verification
roots.pemhas no emSign ECC Root CA - G3. 1.84.0's does.Files changed
uv.lockpyproject.tomldocs/getting-started/installation.mdcodebase_rag/tests/test_build_tls_trust.pyDiff stats
+170 additions, -46 deletions (216 LOC)
Dependency graph
Merge in this order:
Summary by CodeRabbit