This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch v3-4-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/v3-4-test by this push:
new 5869b0e184d [v3-4-test] Bump certifi to 2026.10.19 to drop the
compromised emSign ECC Root CA - G3 (#75302) (#75312)
5869b0e184d is described below
commit 5869b0e184df7a12db2e2a7bd1cfca1db41a5bab
Author: Jarek Potiuk <[email protected]>
AuthorDate: Wed Oct 21 14:25:48 2026 +0200
[v3-4-test] Bump certifi to 2026.10.19 to drop the compromised emSign ECC
Root CA - G3 (#75302) (#75312)
certifi 2026.10.19 removes the emSign ECC Root CA - G3 root after the
eMudhra CA compromise. It is inside the 4-day exclude-newer window, so add a
temporary per-package cutoff to both [tool.uv.exclude-newer-package] and
[tool.uv.pip.exclude-newer-package], following #75296, and relock certifi.
(cherry picked from commit 7e0c1acb426a6b7900f9206049cbc8bce4c37277)
Co-authored-by: Kaxil Naik <[email protected]>
---
pyproject.toml | 6 ++++++
uv.lock | 7 ++++---
2 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/pyproject.toml b/pyproject.toml
index 2422710cd96..bfd835bb999 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1653,6 +1653,10 @@ google-cloud-aiplatform = "2026-08-13T00:00:00Z"
pip = false
uv = false
+# certifi 2026.10.19 removes the compromised "emSign ECC Root CA - G3" root.
Remove this
+# `exclude-newer-package` after 2026-10-25, when that release has been out for
4 days.
+certifi = "2026-10-21T00:00:00Z"
+
[tool.airflow.dependency-floors]
# Floors of these dependencies are raised by `breeze ci upgrade`
(scripts/ci/prek/upgrade_dependency_floors.py),
# see dev/breeze/doc/adr/0018-raise-dependency-floors-automatically.md.
@@ -1842,6 +1846,8 @@ google-cloud-aiplatform = "2026-08-13T00:00:00Z"
# Package managers bypass the cooldown — see `[tool.uv.exclude-newer-package]`.
pip = false
uv = false
+# Temporary: see the certifi note in `[tool.uv.exclude-newer-package]`.
+certifi = "2026-10-21T00:00:00Z"
[tool.uv.sources]
# These names must match the names as defined in the pyproject.toml of the
workspace items,
diff --git a/uv.lock b/uv.lock
index 87956a6ee45..bc129d88b69 100644
--- a/uv.lock
+++ b/uv.lock
@@ -175,6 +175,7 @@ apache-airflow-shared-template-rendering = false
apache-airflow-shared-timezones = false
apache-airflow-task-sdk = false
apache-airflow-task-sdk-integration-tests = false
+certifi = "2026-10-21T00:00:00Z"
google-cloud-aiplatform = "2026-08-13T00:00:00Z"
pydantic-ai-skills = "2026-07-16T00:00:00Z"
@@ -11105,11 +11106,11 @@ redis = [
[[package]]
name = "certifi"
-version = "2026.7.22"
+version = "2026.10.19"
source = { registry = "https://pypi.org/simple"; }
-sdist = { url =
"https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz";,
hash =
"sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size
= 138112, upload-time = "2026-07-22T03:35:12.644Z" }
+sdist = { url =
"https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz";,
hash =
"sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size
= 137598, upload-time = "2026-10-20T02:24:16.604Z" }
wheels = [
- { url =
"https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl";,
hash =
"sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size
= 136983, upload-time = "2026-07-22T03:35:11.276Z" },
+ { url =
"https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl";,
hash =
"sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size
= 136464, upload-time = "2026-10-20T02:24:15.072Z" },
]
[[package]]
