kaxil opened a new pull request, #75302: URL: https://github.com/apache/airflow/pull/75302
`uv.lock` and `constraints-main` pin `certifi==2026.7.22`, whose bundle still trusts the `emSign ECC Root CA - G3` root affected by the eMudhra CA compromise. certifi 2026.10.19 removes that root (the bundle goes from 121 to 120 certificates; the other three emSign roots are unchanged). The official images install from constraints, so they currently ship the old bundle. #75296 raised the uv floor for the same incident but left certifi alone. Following its pattern, this adds a temporary `certifi` cutoff to `[tool.uv.exclude-newer-package]` and `[tool.uv.pip.exclude-newer-package]`, because 2026.10.19 (uploaded 2026-10-20) is still inside the `exclude-newer = "4 days"` window, and relocks with `uv lock --upgrade-package certifi`. The lock diff touches only certifi. Both cutoff entries can be removed after 2026-10-25. `constraints-main` is not edited here. It is regenerated by the "Updating constraints" job on `main`, which resolves with `uv pip` and therefore reads the `[tool.uv.pip]` override. The first constraints refresh after this merges should pick up `certifi==2026.10.19`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
