From a0f3ef0e6ada1b4aa543ae013bfae35472a85d3b Mon Sep 17 00:00:00 2001 From: Bretton Date: Tue, 20 Oct 2026 17:14:35 -0700 Subject: [PATCH] chore(aggregators): require certifi 2026.10.18+ to distrust compromised eMudhra intermediates The aggregator images bundled certifi 2026.7.22 or older, which still trusts the emSign and AAA Certificate Services roots behind the eight compromised eMudhra intermediates (CVE-2026-111943). certifi 2026.10.18 drops them. Verified in freshly built images: the we-have-a-problem.com canary host is rejected and ordinary HTTPS still works. Co-Authored-By: Claude Opus 5.5 --- aggregators/bluesky-topics/requirements.txt | 3 +++ aggregators/kagi-news/requirements.txt | 3 +++ aggregators/reddit-highlights/requirements.txt | 3 +++ 3 files changed, 9 insertions(+) diff --git a/aggregators/bluesky-topics/requirements.txt b/aggregators/bluesky-topics/requirements.txt index 8e1fb52..a2a00f7 100644 --- a/aggregators/bluesky-topics/requirements.txt +++ b/aggregators/bluesky-topics/requirements.txt @@ -4,3 +4,6 @@ pyyaml==6.0.3 idna>=3.7 anthropic==1.7.0 pydantic>=2.0,<3 +# Trust store for requests and the anthropic client. 2026.10.18 drops the +# roots behind the compromised eMudhra intermediates (CVE-2026-111943). +certifi>=2026.10.18 diff --git a/aggregators/kagi-news/requirements.txt b/aggregators/kagi-news/requirements.txt index c2346b5..39d9b38 100644 --- a/aggregators/kagi-news/requirements.txt +++ b/aggregators/kagi-news/requirements.txt @@ -10,3 +10,6 @@ anthropic==1.3.0 # by requests, but declared explicitly because we import it directly — and # because the AppView's Go normalizer is matched against this exact behaviour. idna>=3.7 +# Trust store for requests and the anthropic client. 2026.10.18 drops the +# roots behind the compromised eMudhra intermediates (CVE-2026-111943). +certifi>=2026.10.18 diff --git a/aggregators/reddit-highlights/requirements.txt b/aggregators/reddit-highlights/requirements.txt index 8adb10b..ae47bab 100644 --- a/aggregators/reddit-highlights/requirements.txt +++ b/aggregators/reddit-highlights/requirements.txt @@ -8,3 +8,6 @@ pyyaml==6.0.3 # by requests, but declared explicitly because we import it directly — and # because the AppView's Go normalizer is matched against this exact behaviour. idna>=3.7 +# Trust store for requests and the anthropic client. 2026.10.18 drops the +# roots behind the compromised eMudhra intermediates (CVE-2026-111943). +certifi>=2026.10.18 -- 2.54.0