Repository navigation
chore(deps): bump certifi to 2026.10.19 in src/fetch/uv.lock (1 advisory) #5229
Description
Filed automatically from 1 open Dependabot alert by the daily alert sweep (#4874). The fix is written by hand against v2/main.
| Package | certifi (pip) |
| Manifest | src/fetch/uv.lock |
Vulnerable on v2/main |
2024.8.30 |
| Bump to | 2026.10.19: the lowest listed patched version that no range below covers |
| Scope | runtime |
| Highest severity | critical |
Advisories
| GHSA | CVE | Severity | Vulnerable range | Fixed in | Summary |
|---|---|---|---|---|---|
| GHSA-6q48-6c7w-9gw2 | — | critical | >= 2019.03.09, < 2026.10.19 | 2026.10.19 | certifi bundles emSign root CAs with compromised intermediate CA keys |
Fix
Run uv lock --upgrade-package certifi in src/fetch and commit the refreshed uv.lock. certifi is transitive here, so no declared range names it. If the package that pulls it in caps it below 2026.10.19, add constraint-dependencies = ["certifi>=2026.10.19"] under [tool.uv] in src/fetch/pyproject.toml instead.
Then verify before opening the PR: every locked copy must be outside every range in the Advisories table. node scripts/dependabot-alerts.mjs --dry-run against the branch should report this exposure cleared.
| Vulnerable copy | Version |
|---|---|
certifi |
2024.8.30 |
Note
The GHSA, CVE, severity, range and summary are the advisory's own, as Dependabot reports them. What this sweep verified against v2/main is the installed versions and whether each advisory's range still matches them: GitHub computes alerts from the default branch, so an alert is filed only after that re-check.
Activity