From c4680b6b81eb63f814250bca929bddd31675930e Mon Sep 17 00:00:00 2001 From: Bardi Harborow Date: Thu, 22 Oct 2026 11:29:23 +1100 Subject: [PATCH] security: update certifi to 2026.10.19 (#20387) Updates `certifi` to 2026.10.19 to address [GHSA-6q48-6c7w-9gw2](https://github.com/advisories/GHSA-6q48-6c7w-9gw2). certifi before 2026.10.19 bundles `emSign ECC Root CA - G3`, which chains to the compromised eMudhra intermediate CAs. This only affects TLS connections made by the Sentry SDK when `sentry` is configured, as `sentry_sdk`'s transport is the only runtime user of certifi. Federation and Synapse's other outbound HTTP requests use the system trust store via `platformTrust()`. Python advisory: https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 --------- Signed-off-by: Bardi Harborow --- changelog.d/20387.misc | 1 + poetry.lock | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) create mode 100644 changelog.d/20387.misc diff --git a/changelog.d/20387.misc b/changelog.d/20387.misc new file mode 100644 index 0000000000..12270904f9 --- /dev/null +++ b/changelog.d/20387.misc @@ -0,0 +1 @@ +Update `certifi` to `2026.10.19` to address [GHSA-6q48-6c7w-9gw2](https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2). This only affects TLS connections made by the Sentry SDK when `sentry` is configured, SAML, and a couple utility scripts; federation and Synapse's other outbound HTTP requests use the system trust store. diff --git a/poetry.lock b/poetry.lock index b58e17b57f..138f1d5722 100644 --- a/poetry.lock +++ b/poetry.lock @@ -205,14 +205,14 @@ files = [ [[package]] name = "certifi" -version = "2026.2.25" +version = "2026.10.19" description = "Python package for providing Mozilla's CA Bundle." optional = false python-versions = ">=3.7" groups = ["main", "dev"] files = [ - {file = "certifi-2026.2.25-py3-none-any.whl", hash = "sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa"}, - {file = "certifi-2026.2.25.tar.gz", hash = "sha256:e887ab5cee78ea814d3472169153c2d12cd43b14bd03329a39a9c6e2e80bfba7"}, + {file = "certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b"}, + {file = "certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae"}, ] [[package]]