Repository navigation
build: require certifi>=2026.10.19 to fix GHSA-6q48-6c7w-9gw2 - #13376
Merged
Merged
Conversation
certifi is installed transitively through httpx and posthog, and none of them requires a recent version, so upgrading Haystack kept an old certifi that still trusts the compromised eMudhra/emSign CAs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
sjrl
approved these changes
Oct 21, 2026
Contributor
Coverage report
Click to see where and how coverage changed
This report was generated by python-coverage-comment-action |
||||||||||||||||||||||||
certifi is MPL-2.0, which the checker flags as copyleft. It was already installed transitively via httpx and posthog; it's only listed directly to enforce the security floor for GHSA-6q48-6c7w-9gw2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bogdankostic
enabled auto-merge (squash)
October 21, 2026 18:45
bogdankostic
added a commit
that referenced
this pull request
Oct 21, 2026
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issues
Proposed Changes:
Adds
certifi>=2026.10.19to the core dependencies, the same way #12995 added theanyiofloor.certifi comes in transitively through two direct dependencies:
None of them requires a recent certifi (httpx and httpcore list it without a version, requests asks for
>=2017.4.17). pip only upgrades what it has to, sopip install -U haystack-aikept whatever certifi was already installed. httpx trusts certifi's bundle by default, so every HTTP call Haystack makes, e.g. to OpenAI, would keep trusting the compromised eMudhra/emSign CAs. With the floor, upgrading Haystack pulls in the fixed bundle.The floor is 2026.10.19 rather than 2026.10.18 (the release that first removes the compromised root), following the PSF's recommendation: 10.19 restores the unaffected
emSign Root CA - G1for compatibility.How did you test it?
uv pip compile pyproject.tomlresolvescertifi==2026.10.19, including under the repo's 24hexclude-newercooldown (it was uploaded 2026-10-20 02:24 UTC).>=3.7, so the floor doesn't affect our supported versions.Notes for the reviewer
certifibelow 2026.10.19; the release note tells them to raise the pin.v3.4.1-rc1already contains the Docker fix (build: update Docker image for eMudhra/emSign CA incident #13374). If we want this in v3.4.1 too, it needs to be cherry-picked ontov3.4.xbefore the final release.Checklist
fix:,feat:,build:,chore:,ci:,docs:,style:,refactor:,perf:,test:and added!in case the PR includes breaking changes.🤖 Generated with Claude Code