Repository navigation
Automated pull from rust-lang/fls - #2674
Merged
Merged
Conversation
Python 3.10 has reached its End of Life. See: <https://peps.python.org/pep-0619/>. In addition, I've just found out which versions of Python address the compromised eMudhra intermediate CA keys, and the version `uv` chose for me for this project was *not* one of them. Because Python version specifiers don't have a logical OR operator, we have to pin to versions compatible with 3.11.18. We can't just say `>=3.11.18`, because that would allow `3.12.X` where X < 16 (which is still vulnerable). See: <https://blog.python.org/2026/10/python-3152-31410-31318-31216-31118/> We'll have to do similar in the future when we increase this. Hopefully, every version in Python 3.16 will be safe, so at that point we'd be able to switch back to something like `>=3.16`? Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Fixes: - PYSEC-2026-4320: certifi bundles emSign root CAs with compromised intermediate CA keys Fixed in: 2026.10.18 Advisory information: <GHSA-6q48-6c7w-9gw2> Advisory information: <GHSA-6q48-6c7w-9gw2> Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
build: Update Python and dependencies to address compromised eMudhra certificates
ferrocene-automations
Bot
added
automation
This was done by adopting upstream uv.lock, then running "uv sync".
tshepang
force-pushed
the
automation/pull-subtree/pophtnhn
branch
from
November 2, 2026 13:09
ccf87fb to
b28b939
Compare
dotcarmen
requested changes
Nov 2, 2026
dotcarmen
left a comment
dotcarmen
left a comment
Contributor
There was a problem hiding this comment.
almost all of these changes are downgrades, which we should not do
i'd prefer if you keep the pyproject.toml change and retained all other versions. in fact, it seems certifi has released another version that alleviates some CA pains (the revocation from .19 was too strict, apparently) so i'll have to update all of the repo lockfiles again
i think it's sufficient to revert the changes to the lockfile then run uv lock to eliminate the multi-version-resolving shenanigans
| @@ -24,206 +20,68 @@ wheels = [ | |||
|
|
|||
| [[package]] | |||
| name = "anyio" | |||
| version = "4.15.1" | |||
| version = "4.8.0" | |||
Contributor
There was a problem hiding this comment.
this is a downgrade. can we avoid it?
| ] | ||
|
|
||
| [[package]] | ||
| name = "babel" | ||
| version = "2.18.0" | ||
| version = "2.16.0" |
| ] | ||
|
|
||
| [[package]] | ||
| name = "certifi" | ||
| version = "2026.10.19" | ||
| version = "2026.10.18" |
Contributor
There was a problem hiding this comment.
another downgrade and i especially don't want this one
| ] | ||
|
|
||
| [[package]] | ||
| name = "charset-normalizer" | ||
| version = "3.5.2" | ||
| version = "3.4.1" |
| ] | ||
|
|
||
| [[package]] | ||
| name = "click" | ||
| version = "8.5.0" | ||
| version = "8.1.8" |
Contributor
nevermind, .23 is optional certifi/python-certifi#445 (comment) |
This reverts commit b28b939.
dotcarmen
approved these changes
Nov 2, 2026
dotcarmen
left a comment
dotcarmen
left a comment
Contributor
There was a problem hiding this comment.
if it works, then lgtm
| @@ -649,11 +331,11 @@ wheels = [ | |||
|
|
|||
| [[package]] | |||
| name = "sphinxcontrib-jsmath" | |||
| version = "1.0.1" | |||
| version = "2.0.0" | |||
Contributor
There was a problem hiding this comment.
major version change, just pointing it out.
| { url = "https://files.pythonhosted.org/packages/e5/35/e3b276473f7f38984990eb29cf525ffaed131f6136bedb929b5c2ce7151e/websockets-17.2-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:80cbc645af23ac5c12096545c161626960114a1bc10f864760558d3b3e82ba18", size = 217355, upload-time = "2026-10-03T14:56:48.654Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/aa/a1/459ab96c5cda8a2164f594be6dc9f868de7971e6abafa696ea07534139a6/websockets-17.2-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:063508ce9e0db745f30ab52fc652f4e59efc79c2b74934b3837d5cdb974da620", size = 218612, upload-time = "2026-10-03T14:56:50.287Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/8a/58/835cd51934d6780fa586f275b5d9901eead6d81569b4343b3767cdbaae4c/websockets-17.2-py3-none-any.whl", hash = "sha256:6aa59f0ef92e796b2db6f5f26550c4713c0e4036899fadf02f55e2ed4db0b7ae", size = 211883, upload-time = "2026-10-03T14:56:51.898Z" }, | ||
| version = "17.3" |
Contributor
There was a problem hiding this comment.
another major version change
Member
|
bors merge |
Contributor
|
Build succeeded:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR pulls the following changes from the
rust-lang/flsrepository:735: build: Update Python and dependencies to address compromised eMudhra certificates