From 575cdf6d273d6a29c144ef080a8f108eaa732e26 Mon Sep 17 00:00:00 2001 From: dervoeti Date: Wed, 21 Oct 2026 14:08:39 +0000 Subject: [PATCH 1/4] fix: Remove trust in compromised emSign ECC Root CA - G3 (GHSA-6q48-6c7w-9gw2, GHSA-hq85-5cpj-mr62) --- CHANGELOG.md | 8 +++++++ airflow/Dockerfile | 21 ++++++++++++++++++- airflow/boil-config.toml | 8 +++---- .../2.9.3/constraints-python3.9.txt | 2 +- .../3.0.6/constraints-python3.12.txt | 4 ++-- .../3.2.2/constraints-python3.14.txt | 4 ++-- .../3.3.2/constraints-python3.14.txt | 4 ++-- opensearch-dashboards/Dockerfile | 4 ++++ spark-connect-client/Dockerfile | 5 +++++ superset/boil-config.toml | 4 ++-- .../constraints/4.1.4/constraints.txt | 2 +- .../constraints/6.1.0/constraints.txt | 2 +- 12 files changed, 52 insertions(+), 16 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index acee9a8e1..f121d2a8b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -97,6 +97,12 @@ All notable changes to this project will be documented in this file. - airflow: Bump `apache-airflow-providers-cncf-kubernetes` to `10.18.0` for `3.2.2`. This version includes a fix for scheduler crashloops when using KubernetesExecutor ([#1709]). - hive: Bump hive-metastore-opa-authorizer to 1.0.1 to fix a [serialization bug](https://github.com/boschglobal/hive-metastore-opa-authorizer/pull/3) ([#1712]). +- stackable-base: Remove the `emSign ECC Root CA - G3` root certificate from the system trust store, as private keys of eMudhra intermediate CAs chaining to it were compromised ([GHSA-6q48-6c7w-9gw2]). +- airflow: Bump certifi to `2026.10.19` and uv to `0.13.4`, and point grpcio to the system trust store ([GHSA-6q48-6c7w-9gw2], [GHSA-hq85-5cpj-mr62]). +- airflow: Bump the bundled pip to `26.2.2` for Airflow 3.x. For Airflow 2.9.3, which uses Python 3.9 and cannot use this pip version, point pip to the system trust store instead ([GHSA-6q48-6c7w-9gw2]). +- superset: Bump certifi to `2026.10.19` and uv to `0.13.4` ([GHSA-6q48-6c7w-9gw2], [GHSA-hq85-5cpj-mr62]). +- opensearch-dashboards: Use the system trust store for Node.js instead of its bundled root certificates ([GHSA-6q48-6c7w-9gw2]). +- spark-connect-client: Point grpcio to the system trust store ([GHSA-6q48-6c7w-9gw2]). ### Removed @@ -167,6 +173,8 @@ All notable changes to this project will be documented in this file. [#1710]: https://github.com/stackabletech/docker-images/pull/1710 [#1712]: https://github.com/stackabletech/docker-images/pull/1712 [#1713]: https://github.com/stackabletech/docker-images/pull/1713 +[GHSA-6q48-6c7w-9gw2]: https://github.com/advisories/GHSA-6q48-6c7w-9gw2 +[GHSA-hq85-5cpj-mr62]: https://github.com/advisories/GHSA-hq85-5cpj-mr62 ## [26.7.0] - 2026-07-21 diff --git a/airflow/Dockerfile b/airflow/Dockerfile index 1b80ae0cc..cb90cc53d 100644 --- a/airflow/Dockerfile +++ b/airflow/Dockerfile @@ -155,7 +155,19 @@ ENV UV_LINK_MODE=copy ENV UV_PYTHON_INSTALL_DIR=/stackable/python # This installs the Python runtime -RUN uv venv --python "${PYTHON_VERSION}" --system-site-packages /stackable/app +RUN <= 3.10. For Python 3.9, pip falls back +# to PIP_CERT (set in the final image) instead. +if [ "${PYTHON_VERSION}" != "3.9" ]; then + # Upgrade pip in the uv-managed base interpreter (not the venv), which is where pip lives. + # uv marks this interpreter as externally managed, so --break-system-packages is required. + uv pip install --python "$(uv python find --system --managed-python "${PYTHON_VERSION}")" --break-system-packages pip==26.2.2 +fi +EOF # Instead of activating the environment each time ENV VIRTUAL_ENV=/stackable/app @@ -325,6 +337,13 @@ ENV VIRTUAL_ENV=$HOME/app ENV AIRFLOW_USER_HOME_DIR=$HOME ENV PATH=$HOME/app/bin:$PATH:/bin ENV AIRFLOW_HOME=$HOME/airflow +# On Python 3.9 (Airflow 2.x), pip uses its own vendored copy of certifi instead of the system trust store. +# Point it to the system trust store, so it does not trust the compromised +# "emSign ECC Root CA - G3" root certificate (GHSA-6q48-6c7w-9gw2), which is removed in stackable-base. +# On newer Python versions pip ignores this in favour of truststore, see the pip upgrade in the build stage. +ENV PIP_CERT=/etc/pki/tls/certs/ca-bundle.crt +# Same for grpcio, which bundles its own roots.pem +ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/pki/tls/certs/ca-bundle.crt COPY --from=airflow-build-image --chown=${STACKABLE_USER_UID}:0 /stackable/ ${HOME}/ diff --git a/airflow/boil-config.toml b/airflow/boil-config.toml index 4660ed993..0519dafa5 100644 --- a/airflow/boil-config.toml +++ b/airflow/boil-config.toml @@ -33,7 +33,7 @@ tini-version = "0.19.0" # Bump to the latest release found here: https://github.com/astral-sh/uv/releases # Mirror uv (no `v` prefix) via https://github.com/stackabletech/docker-images/actions/workflows/mirror.yaml # Note: Mirrored to the `stackable` project, but should probably move elsewhere. -uv-version = "0.11.19" +uv-version = "0.13.4" airflow-extras-other = "async,amazon,celery,cncf.kubernetes,docker,dask,elasticsearch,ftp,grpc,hashicorp,http,ldap,google,google_auth,microsoft.azure,odbc,pandas,postgres,redis,sendgrid,sftp,slack,ssh,statsd,virtualenv,trino" opa-auth-manager = "airflow-2" # Node module stream used to install pnpm/yarn and build the frontend assets. @@ -73,7 +73,7 @@ tini-version = "0.19.0" # Bump to the latest release found here: https://github.com/astral-sh/uv/releases # Mirror uv (no `v` prefix) via https://github.com/stackabletech/docker-images/actions/workflows/mirror.yaml # Note: Mirrored to the `stackable` project, but should probably move elsewhere. -uv-version = "0.11.19" +uv-version = "0.13.4" # Airflow extras are defined in separate lists to make them easier to check against the links below. # The lists will be concatenated and duplicates removed in the dockerfile. @@ -134,7 +134,7 @@ tini-version = "0.19.0" # Bump to the latest release found here: https://github.com/astral-sh/uv/releases # Mirror uv (no `v` prefix) via https://github.com/stackabletech/docker-images/actions/workflows/mirror.yaml # Note: Mirrored to the `stackable` project, but should probably move elsewhere. -uv-version = "0.11.19" +uv-version = "0.13.4" # Airflow extras are defined in separate lists to make them easier to check against the links below. # The lists will be concatenated and duplicates removed in the dockerfile. @@ -195,7 +195,7 @@ tini-version = "0.19.0" # Bump to the latest release found here: https://github.com/astral-sh/uv/releases # Mirror uv (no `v` prefix) via https://github.com/stackabletech/docker-images/actions/workflows/mirror.yaml # Note: Mirrored to the `stackable` project, but should probably move elsewhere. -uv-version = "0.11.19" +uv-version = "0.13.4" # Airflow extras are defined in separate lists to make them easier to check against the links below. # The lists will be concatenated and duplicates removed in the dockerfile. diff --git a/airflow/stackable/constraints/2.9.3/constraints-python3.9.txt b/airflow/stackable/constraints/2.9.3/constraints-python3.9.txt index b201108c0..13adadb4a 100644 --- a/airflow/stackable/constraints/2.9.3/constraints-python3.9.txt +++ b/airflow/stackable/constraints/2.9.3/constraints-python3.9.txt @@ -241,7 +241,7 @@ cachetools==5.3.3 cassandra-driver==3.29.1 cattrs==23.2.3 celery==5.4.0 -certifi==2024.7.4 +certifi==2026.10.19 cffi==1.16.0 cfgv==3.4.0 cfn-lint==1.6.0 diff --git a/airflow/stackable/constraints/3.0.6/constraints-python3.12.txt b/airflow/stackable/constraints/3.0.6/constraints-python3.12.txt index 68553f32b..8b5255ecb 100644 --- a/airflow/stackable/constraints/3.0.6/constraints-python3.12.txt +++ b/airflow/stackable/constraints/3.0.6/constraints-python3.12.txt @@ -264,7 +264,7 @@ cattrs==25.1.1 # Bumped to newest version (from 5.5.2) to reduce celery on redis issues # See https://github.com/stackabletech/airflow-operator/issues/676 celery==5.5.3 -certifi==2025.8.3 +certifi==2026.10.19 cffi==1.17.1 cfgv==3.4.0 cfn-lint==1.39.0 @@ -809,7 +809,7 @@ uritemplate==4.2.0 urllib3==2.5.0 userpath==1.9.2 uuid6==2025.0.1 -uv==0.8.13 +uv==0.13.4 # Stackable patch: # The original version 0.35.0 hard codes the worker timeout to 5s. # This has been fixed in 0.37.0 so that the value passed through from Airflow diff --git a/airflow/stackable/constraints/3.2.2/constraints-python3.14.txt b/airflow/stackable/constraints/3.2.2/constraints-python3.14.txt index a35f39ebb..3a8e491df 100644 --- a/airflow/stackable/constraints/3.2.2/constraints-python3.14.txt +++ b/airflow/stackable/constraints/3.2.2/constraints-python3.14.txt @@ -244,7 +244,7 @@ cachetools==7.1.4 cadwyn==6.2.2 cattrs==26.1.0 celery==5.6.3 -certifi==2026.5.20 +certifi==2026.10.19 cffi==2.0.0 chardet==6.0.0.post1 charset-normalizer==3.4.7 @@ -660,7 +660,7 @@ universal_pathlib==0.3.10 uritemplate==4.2.0 urllib3==2.7.0 uuid6==2025.0.1 -uv==0.11.16 +uv==0.13.4 uvicorn==0.47.0 uvloop==0.22.1 validators==0.35.0 diff --git a/airflow/stackable/constraints/3.3.2/constraints-python3.14.txt b/airflow/stackable/constraints/3.3.2/constraints-python3.14.txt index 54cdd7366..e6e056f60 100644 --- a/airflow/stackable/constraints/3.3.2/constraints-python3.14.txt +++ b/airflow/stackable/constraints/3.3.2/constraints-python3.14.txt @@ -247,7 +247,7 @@ cadwyn==7.0.0 capi_param_builder_python==1.3.0 cattrs==26.2.0 celery==5.6.3 -certifi==2026.7.22 +certifi==2026.10.19 cffi==2.1.1 chardet==7.6.0 charset-normalizer==3.5.1 @@ -684,7 +684,7 @@ universal_pathlib==0.3.10 uritemplate==4.2.0 urllib3==2.7.0 uuid6==2025.0.1 -uv==0.12.13 +uv==0.13.4 uvicorn==0.52.4 uvloop==0.22.1 validators==0.35.0 diff --git a/opensearch-dashboards/Dockerfile b/opensearch-dashboards/Dockerfile index e5912d930..8cb0f9d3a 100644 --- a/opensearch-dashboards/Dockerfile +++ b/opensearch-dashboards/Dockerfile @@ -344,6 +344,10 @@ USER ${STACKABLE_USER_UID} ENV HOME=${HOME} ENV OPENSEARCH_DASHBOARDS_HOME=${OPENSEARCH_DASHBOARDS_HOME} ENV PATH="${PATH}:/${OPENSEARCH_DASHBOARDS_HOME}:${OPENSEARCH_DASHBOARDS_HOME}/bin" +# Node.js uses its own bundled copy of the Mozilla root certificates instead of the system trust store. +# Use the system trust store instead, so Node.js does not trust the compromised +# "emSign ECC Root CA - G3" root certificate (GHSA-6q48-6c7w-9gw2), which is removed in stackable-base. +ENV NODE_OPTIONS="--use-openssl-ca" WORKDIR ${OPENSEARCH_DASHBOARDS_HOME} CMD ["opensearch-dashboards-docker-entrypoint.sh"] diff --git a/spark-connect-client/Dockerfile b/spark-connect-client/Dockerfile index 6655b1447..226601113 100644 --- a/spark-connect-client/Dockerfile +++ b/spark-connect-client/Dockerfile @@ -52,4 +52,9 @@ RUN pip install --no-cache-dir --user \ "scikit-learn==${SCIKIT_LEARN_VERSION}" \ "matplotlib==${MATPLOTLIB_VERSION}" +# grpcio uses its own bundled roots.pem instead of the system trust store. +# Point it to the system trust store, so it does not trust the compromised +# "emSign ECC Root CA - G3" root certificate (GHSA-6q48-6c7w-9gw2), which is removed in stackable-base. +ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/pki/tls/certs/ca-bundle.crt + WORKDIR /stackable diff --git a/superset/boil-config.toml b/superset/boil-config.toml index 12ed7189a..2a376e174 100644 --- a/superset/boil-config.toml +++ b/superset/boil-config.toml @@ -25,7 +25,7 @@ authlib-version = "1.2.1" # and upstream CI tests 3.10 and 3.11 (https://github.com/apache/superset/blob/4.1.4/.github/actions/setup-backend/action.yml) python-version = "3.11" # Independent of Superset, use the latest release: https://github.com/astral-sh/uv/releases -uv-version = "0.11.18" +uv-version = "0.13.4" # https://github.com/apache/superset/blob/4.1.4/superset-frontend/.nvmrc nodejs-version = "18.20.1" # The latest 10.x release. 11.x requires Node ^20.17.0 || >=22.9.0. @@ -57,7 +57,7 @@ authlib-version = "1.2.1" # and a py312 image variant is published. We use 3.12 python-version = "3.12" # Independent of Superset, use the latest release: https://github.com/astral-sh/uv/releases -uv-version = "0.11.18" +uv-version = "0.13.4" # https://github.com/apache/superset/blob/6.1.0/superset-frontend/.nvmrc nodejs-version = "22.22.0" # superset-frontend requires npm ^10.8.1 (https://github.com/apache/superset/blob/6.1.0/superset-frontend/package.json, diff --git a/superset/stackable/constraints/4.1.4/constraints.txt b/superset/stackable/constraints/4.1.4/constraints.txt index 2bec952c0..c6331f13a 100644 --- a/superset/stackable/constraints/4.1.4/constraints.txt +++ b/superset/stackable/constraints/4.1.4/constraints.txt @@ -38,7 +38,7 @@ cattrs==23.2.3 # via requests-cache celery==5.4.0 # via apache-superset -certifi==2024.2.2 +certifi==2026.10.19 # via requests cffi==1.16.0 # via diff --git a/superset/stackable/constraints/6.1.0/constraints.txt b/superset/stackable/constraints/6.1.0/constraints.txt index 68fffee2e..dd207560b 100644 --- a/superset/stackable/constraints/6.1.0/constraints.txt +++ b/superset/stackable/constraints/6.1.0/constraints.txt @@ -49,7 +49,7 @@ cattrs==25.1.1 # via requests-cache celery==5.5.2 # via apache-superset (pyproject.toml) -certifi==2025.6.15 +certifi==2026.10.19 # via # requests # selenium From 54c4e3b210346a92040644f568141e143a8ef8b1 Mon Sep 17 00:00:00 2001 From: dervoeti Date: Mon, 26 Oct 2026 08:19:28 +0000 Subject: [PATCH 2/4] chore: Add PR number to changelog entries for emSign CA removal --- CHANGELOG.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f121d2a8b..3aac081fd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -97,12 +97,11 @@ All notable changes to this project will be documented in this file. - airflow: Bump `apache-airflow-providers-cncf-kubernetes` to `10.18.0` for `3.2.2`. This version includes a fix for scheduler crashloops when using KubernetesExecutor ([#1709]). - hive: Bump hive-metastore-opa-authorizer to 1.0.1 to fix a [serialization bug](https://github.com/boschglobal/hive-metastore-opa-authorizer/pull/3) ([#1712]). -- stackable-base: Remove the `emSign ECC Root CA - G3` root certificate from the system trust store, as private keys of eMudhra intermediate CAs chaining to it were compromised ([GHSA-6q48-6c7w-9gw2]). -- airflow: Bump certifi to `2026.10.19` and uv to `0.13.4`, and point grpcio to the system trust store ([GHSA-6q48-6c7w-9gw2], [GHSA-hq85-5cpj-mr62]). -- airflow: Bump the bundled pip to `26.2.2` for Airflow 3.x. For Airflow 2.9.3, which uses Python 3.9 and cannot use this pip version, point pip to the system trust store instead ([GHSA-6q48-6c7w-9gw2]). -- superset: Bump certifi to `2026.10.19` and uv to `0.13.4` ([GHSA-6q48-6c7w-9gw2], [GHSA-hq85-5cpj-mr62]). -- opensearch-dashboards: Use the system trust store for Node.js instead of its bundled root certificates ([GHSA-6q48-6c7w-9gw2]). -- spark-connect-client: Point grpcio to the system trust store ([GHSA-6q48-6c7w-9gw2]). +- airflow: Bump certifi to `2026.10.19` and uv to `0.13.4`, and point grpcio to the system trust store ([GHSA-6q48-6c7w-9gw2], [GHSA-hq85-5cpj-mr62], [#1715]). +- airflow: Bump the bundled pip to `26.2.2` for Airflow 3.x. For Airflow 2.9.3, which uses Python 3.9 and cannot use this pip version, point pip to the system trust store instead ([GHSA-6q48-6c7w-9gw2], [#1715]). +- superset: Bump certifi to `2026.10.19` and uv to `0.13.4` ([GHSA-6q48-6c7w-9gw2], [GHSA-hq85-5cpj-mr62], [#1715]). +- opensearch-dashboards: Use the system trust store for Node.js instead of its bundled root certificates ([GHSA-6q48-6c7w-9gw2], [#1715]). +- spark-connect-client: Point grpcio to the system trust store ([GHSA-6q48-6c7w-9gw2], [#1715]). ### Removed @@ -173,6 +172,7 @@ All notable changes to this project will be documented in this file. [#1710]: https://github.com/stackabletech/docker-images/pull/1710 [#1712]: https://github.com/stackabletech/docker-images/pull/1712 [#1713]: https://github.com/stackabletech/docker-images/pull/1713 +[#1715]: https://github.com/stackabletech/docker-images/pull/1715 [GHSA-6q48-6c7w-9gw2]: https://github.com/advisories/GHSA-6q48-6c7w-9gw2 [GHSA-hq85-5cpj-mr62]: https://github.com/advisories/GHSA-hq85-5cpj-mr62 From 830a17f5355b114779811cd192505fbaa3a5bdb1 Mon Sep 17 00:00:00 2001 From: dervoeti Date: Mon, 26 Oct 2026 08:35:47 +0000 Subject: [PATCH 3/4] chore: Allow certifi in typos config --- typos.toml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/typos.toml b/typos.toml index 0719d9624..040188a7b 100644 --- a/typos.toml +++ b/typos.toml @@ -48,3 +48,6 @@ vertica = "vertica" # Maven profile activation flag, as in `mvn -Prelease` (hbase/hbase/Dockerfile). # It sits inside a RUN continuation, where a trailing comment would break the line. Prelease = "Prelease" +# Python package with Mozilla's root certificates, referenced in Dockerfiles, +# boil-config.toml files and CHANGELOG.md. +certifi = "certifi" From cd2b3e558ccaed68761cc3ee77a9a5075e1e31a7 Mon Sep 17 00:00:00 2001 From: dervoeti Date: Mon, 26 Oct 2026 14:57:05 +0000 Subject: [PATCH 4/4] fix: Address review feedback: bump certifi to 2026.10.23, add documentation links --- CHANGELOG.md | 4 ++-- airflow/Dockerfile | 7 +++++-- .../stackable/constraints/2.9.3/constraints-python3.9.txt | 2 +- .../stackable/constraints/3.0.6/constraints-python3.12.txt | 2 +- .../stackable/constraints/3.2.2/constraints-python3.14.txt | 2 +- .../stackable/constraints/3.3.2/constraints-python3.14.txt | 2 +- opensearch-dashboards/Dockerfile | 4 +++- spark-connect-client/Dockerfile | 3 ++- superset/stackable/constraints/4.1.4/constraints.txt | 2 +- superset/stackable/constraints/6.1.0/constraints.txt | 2 +- 10 files changed, 18 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 26934dfe8..fc151d423 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -102,9 +102,9 @@ All notable changes to this project will be documented in this file. - airflow: Bump `apache-airflow-providers-cncf-kubernetes` to `10.18.0` for `3.2.2`. This version includes a fix for scheduler crashloops when using KubernetesExecutor ([#1709]). - hive: Bump hive-metastore-opa-authorizer to 1.0.1 to fix a [serialization bug](https://github.com/boschglobal/hive-metastore-opa-authorizer/pull/3) ([#1712]). -- airflow: Bump certifi to `2026.10.19` and uv to `0.13.4`, and point grpcio to the system trust store ([#1715]). +- airflow: Bump certifi to `2026.10.23` and uv to `0.13.4`, and point grpcio to the system trust store ([#1715]). - airflow: Bump the bundled pip to `26.2.2` for Airflow 3.x. For Airflow 2.9.3, which uses Python 3.9 and cannot use this pip version, point pip to the system trust store instead ([#1715]). -- superset: Bump certifi to `2026.10.19` and uv to `0.13.4` ([#1715]). +- superset: Bump certifi to `2026.10.23` and uv to `0.13.4` ([#1715]). - opensearch-dashboards: Use the system trust store for Node.js instead of its bundled root certificates ([#1715]). - spark-connect-client: Point grpcio to the system trust store ([#1715]). diff --git a/airflow/Dockerfile b/airflow/Dockerfile index cb90cc53d..0ed2539ce 100644 --- a/airflow/Dockerfile +++ b/airflow/Dockerfile @@ -339,10 +339,13 @@ ENV PATH=$HOME/app/bin:$PATH:/bin ENV AIRFLOW_HOME=$HOME/airflow # On Python 3.9 (Airflow 2.x), pip uses its own vendored copy of certifi instead of the system trust store. # Point it to the system trust store, so it does not trust the compromised -# "emSign ECC Root CA - G3" root certificate (GHSA-6q48-6c7w-9gw2), which is removed in stackable-base. +# "emSign ECC Root CA - G3" root certificate (GHSA-6q48-6c7w-9gw2), which the system trust store no longer contains. # On newer Python versions pip ignores this in favour of truststore, see the pip upgrade in the build stage. +# PIP_CERT sets pip's --cert option, see https://pip.pypa.io/en/stable/cli/pip/#cmdoption-cert +# and https://pip.pypa.io/en/stable/topics/configuration/#environment-variables ENV PIP_CERT=/etc/pki/tls/certs/ca-bundle.crt -# Same for grpcio, which bundles its own roots.pem +# Same for grpcio, which bundles its own roots.pem, +# see https://github.com/grpc/grpc/blob/master/doc/environment_variables.md ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/pki/tls/certs/ca-bundle.crt COPY --from=airflow-build-image --chown=${STACKABLE_USER_UID}:0 /stackable/ ${HOME}/ diff --git a/airflow/stackable/constraints/2.9.3/constraints-python3.9.txt b/airflow/stackable/constraints/2.9.3/constraints-python3.9.txt index 13adadb4a..0589711a9 100644 --- a/airflow/stackable/constraints/2.9.3/constraints-python3.9.txt +++ b/airflow/stackable/constraints/2.9.3/constraints-python3.9.txt @@ -241,7 +241,7 @@ cachetools==5.3.3 cassandra-driver==3.29.1 cattrs==23.2.3 celery==5.4.0 -certifi==2026.10.19 +certifi==2026.10.23 cffi==1.16.0 cfgv==3.4.0 cfn-lint==1.6.0 diff --git a/airflow/stackable/constraints/3.0.6/constraints-python3.12.txt b/airflow/stackable/constraints/3.0.6/constraints-python3.12.txt index 8b5255ecb..57fa44bdf 100644 --- a/airflow/stackable/constraints/3.0.6/constraints-python3.12.txt +++ b/airflow/stackable/constraints/3.0.6/constraints-python3.12.txt @@ -264,7 +264,7 @@ cattrs==25.1.1 # Bumped to newest version (from 5.5.2) to reduce celery on redis issues # See https://github.com/stackabletech/airflow-operator/issues/676 celery==5.5.3 -certifi==2026.10.19 +certifi==2026.10.23 cffi==1.17.1 cfgv==3.4.0 cfn-lint==1.39.0 diff --git a/airflow/stackable/constraints/3.2.2/constraints-python3.14.txt b/airflow/stackable/constraints/3.2.2/constraints-python3.14.txt index 3a8e491df..fdd6fc18a 100644 --- a/airflow/stackable/constraints/3.2.2/constraints-python3.14.txt +++ b/airflow/stackable/constraints/3.2.2/constraints-python3.14.txt @@ -244,7 +244,7 @@ cachetools==7.1.4 cadwyn==6.2.2 cattrs==26.1.0 celery==5.6.3 -certifi==2026.10.19 +certifi==2026.10.23 cffi==2.0.0 chardet==6.0.0.post1 charset-normalizer==3.4.7 diff --git a/airflow/stackable/constraints/3.3.2/constraints-python3.14.txt b/airflow/stackable/constraints/3.3.2/constraints-python3.14.txt index e6e056f60..5158abe76 100644 --- a/airflow/stackable/constraints/3.3.2/constraints-python3.14.txt +++ b/airflow/stackable/constraints/3.3.2/constraints-python3.14.txt @@ -247,7 +247,7 @@ cadwyn==7.0.0 capi_param_builder_python==1.3.0 cattrs==26.2.0 celery==5.6.3 -certifi==2026.10.19 +certifi==2026.10.23 cffi==2.1.1 chardet==7.6.0 charset-normalizer==3.5.1 diff --git a/opensearch-dashboards/Dockerfile b/opensearch-dashboards/Dockerfile index 8cb0f9d3a..98a2f1242 100644 --- a/opensearch-dashboards/Dockerfile +++ b/opensearch-dashboards/Dockerfile @@ -346,7 +346,9 @@ ENV OPENSEARCH_DASHBOARDS_HOME=${OPENSEARCH_DASHBOARDS_HOME} ENV PATH="${PATH}:/${OPENSEARCH_DASHBOARDS_HOME}:${OPENSEARCH_DASHBOARDS_HOME}/bin" # Node.js uses its own bundled copy of the Mozilla root certificates instead of the system trust store. # Use the system trust store instead, so Node.js does not trust the compromised -# "emSign ECC Root CA - G3" root certificate (GHSA-6q48-6c7w-9gw2), which is removed in stackable-base. +# "emSign ECC Root CA - G3" root certificate (GHSA-6q48-6c7w-9gw2), which the system trust store no longer contains. +# See https://nodejs.org/docs/latest-v20.x/api/cli.html#--use-bundled-ca---use-openssl-ca +# and https://nodejs.org/docs/latest-v20.x/api/cli.html#node_optionsoptions ENV NODE_OPTIONS="--use-openssl-ca" WORKDIR ${OPENSEARCH_DASHBOARDS_HOME} diff --git a/spark-connect-client/Dockerfile b/spark-connect-client/Dockerfile index 226601113..96a1d5e3b 100644 --- a/spark-connect-client/Dockerfile +++ b/spark-connect-client/Dockerfile @@ -54,7 +54,8 @@ RUN pip install --no-cache-dir --user \ # grpcio uses its own bundled roots.pem instead of the system trust store. # Point it to the system trust store, so it does not trust the compromised -# "emSign ECC Root CA - G3" root certificate (GHSA-6q48-6c7w-9gw2), which is removed in stackable-base. +# "emSign ECC Root CA - G3" root certificate (GHSA-6q48-6c7w-9gw2), which the system trust store no longer contains. +# See https://github.com/grpc/grpc/blob/master/doc/environment_variables.md ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/pki/tls/certs/ca-bundle.crt WORKDIR /stackable diff --git a/superset/stackable/constraints/4.1.4/constraints.txt b/superset/stackable/constraints/4.1.4/constraints.txt index c6331f13a..8e1613e99 100644 --- a/superset/stackable/constraints/4.1.4/constraints.txt +++ b/superset/stackable/constraints/4.1.4/constraints.txt @@ -38,7 +38,7 @@ cattrs==23.2.3 # via requests-cache celery==5.4.0 # via apache-superset -certifi==2026.10.19 +certifi==2026.10.23 # via requests cffi==1.16.0 # via diff --git a/superset/stackable/constraints/6.1.0/constraints.txt b/superset/stackable/constraints/6.1.0/constraints.txt index dd207560b..71b81616a 100644 --- a/superset/stackable/constraints/6.1.0/constraints.txt +++ b/superset/stackable/constraints/6.1.0/constraints.txt @@ -49,7 +49,7 @@ cattrs==25.1.1 # via requests-cache celery==5.5.2 # via apache-superset (pyproject.toml) -certifi==2026.10.19 +certifi==2026.10.23 # via # requests # selenium