[parashardhapola]

On 20 October 2026 the Python Software Foundation announced that intermediate certificates under eMudhra's emSign ECC Root CA - G3 were compromised. certifi 2026.10.19 and uv 0.13.4 (GHSA-hq85-5cpj-mr62) stop trusting that root. The lock still had certifi 2026.7.22, and the publish workflow pinned uv 0.13.0.

Changes

• uv.lock: certifi 2026.7.22 to 2026.10.19, the only package that changes. Development environments, CI, the Docker image, and both Modal images install from the lock.
• pyproject.toml: [tool.uv] required-version = ">=0.13.4", so older uv releases refuse to lock, sync, or run the project. setup-uv in the test and docs workflows already installs the latest uv.
• publish.yml: the build and wheel-test jobs pin uv 0.13.5 instead of 0.13.0.
• The contributing guide states the uv requirement and how to update uv.

Validation

• uv lock --check passes with uv 0.13.5, and uv 0.11.7 stops with "Required uv version >=0.13.4 does not match the running version".
• uv 0.13.5, which no longer trusts the root, resolves the same certifi wheel and sdist hashes as the lock records.
• certifi 2026.10.19's bundle drops emSign ECC Root CA - G3 and keeps emSign Root CA - G1, emSign Root CA - C1, and emSign ECC Root CA - C3.

After merging

• Update uv locally with UV_SYSTEM_CERTS=true uv self update, then run uv sync.
• Rebuild Docker images with docker build --pull --no-cache ., so the build fetches the current uv:latest and system certificates instead of reusing cached layers.
• Both Modal images install from the lock with uv_sync, so they pick up the new certifi when they next build.
• CyteArc sets no minimum certifi for its users, whose environments provide it. The announcement covers updating pip, certifi, uv, and conda.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!