[tayden]

Why

On 2026-10-20 the eMudhra emSign root CA was removed from CA bundles after its intermediate CA private keys were found to be trivially weak, which opens TLS clients (including pip/uv talking to PyPI) to MITM attacks.
Advisory: https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576

Fixed versions: pip >= 26.2.2, uv >= 0.13.4, certifi >= 2026.10.19, conda >= 26.9.4.

Changes

• uv.lock: certifi 2025.8.3 -> 2026.10.23 (hand-edited certifi entry, hashes/sizes verified against PyPI; uv lock would also have bumped lock revision and rewritten unrelated markers)

Follow-up / needs attention

• Supported Pythons changed (3a4efee): requires-python is now >=3.11, and 3.8–3.10 are dropped (EOL). The CI matrix now runs 3.11–3.15, mypy targets 3.11, and the README is updated. The lock was regenerated and pyyaml bumped to 6.0.3. Ruff fixes from the 3.11 target are in the tests only (timezone.utc → datetime.UTC). This is a breaking change for 3.8–3.10 users, so it's worth a minor version bump on release.
• Lint fix (d2fad33): CI's ruff-action installs the latest ruff (0.17.2), and its new preview rule property-docstring-starts-with-verb flagged 6 property docstrings, which are now reworded.

Tracking issue: HakaiInstitute/hakai-it#44

[tayden]

Review notes / gotchas

Things to check before merging this patch for the emSign CA incident (tracking: HakaiInstitute/hakai-it#44):

• Python ≤ 3.9: the test matrix includes 3.9, and requires-python is >=3.8. pip 26.2.2 requires Python ≥ 3.10, so pip can't be patched there. Either drop 3.9 or install with uv ≥ 0.13.4.
• Hand-edited lockfile: only the certifi entry was changed, with the version, URLs and hashes copied from PyPI. Running uv lock would also have rewritten unrelated entries. If you regenerate the lock later, check that certifi stays at ≥ 2026.10.19.

[tayden]

Pushed two commits:

• 3a4efee: the package now requires Python >= 3.11 (3.8–3.10 are EOL), and CI tests 3.11–3.15. Locally, all 63 tests pass on 3.11 and 3.15.
• d2fad33: fixes the failing lint job. astral-sh/ruff-action installs the latest ruff (now 0.17.2), and with preview = true its new property-docstring-starts-with-verb rule flagged 6 property docstrings. This would now fail on main too. main's last lint run passed only because it ran before ruff 0.17. The commit message says it was already failing on main, which isn't quite accurate. To stop new ruff releases from breaking CI like this, you could pin the ruff version in the action (with: version: ...).

Note: ruff 0.17's formatter now also formats Python code blocks in README.md. CI doesn't run ruff format, so I left the README alone.