From 4fceb36dcd7e6290cd6f966ccb030b694a66737a Mon Sep 17 00:00:00 2001 From: Jover Lee Date: Wed, 21 Oct 2026 10:18:36 -0700 Subject: [PATCH 1/2] Add minimum version for certifi Minimum version of certifi for CA certificate incident: --- CHANGES.md | 5 +++++ doc/changes.md | 6 ++++++ setup.py | 4 +++- 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/CHANGES.md b/CHANGES.md index 0a07a46a..e12eb110 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -13,6 +13,11 @@ development source code and as such may not be routinely kept up to date. # __NEXT__ +## Development + +* Set minimum version requirement for certifi to 2026.10.19 in response to + [CA certificate compromise incident](https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576). + ([#549](https://github.com/nextstrain/cli/pull/549)) # 11.1.0 (15 October 2026) diff --git a/doc/changes.md b/doc/changes.md index 81a60865..88ce07e5 100644 --- a/doc/changes.md +++ b/doc/changes.md @@ -16,6 +16,12 @@ development source code and as such may not be routinely kept up to date. (v-next)= ## __NEXT__ +(v-next-development)= +### Development + +* Set minimum version requirement for certifi to 2026.10.19 in response to + [CA certificate compromise incident](https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576). + ([#549](https://github.com/nextstrain/cli/pull/549)) (v11-1-0)= ## 11.1.0 (15 October 2026) diff --git a/setup.py b/setup.py index 1e2a02f0..c8b24afc 100644 --- a/setup.py +++ b/setup.py @@ -89,7 +89,9 @@ def find_namespaced_packages(namespace): python_requires = '>=3.10', install_requires = [ - "certifi", + # Minimum version of certifi for CA certificate incident + # + "certifi >=2026.10.19", "docutils", "fasteners", "importlib_resources >=5.3.0; python_version < '3.11'", From 2ef2f1b99ad32d25d237a25dbe0c47f12e7e1455 Mon Sep 17 00:00:00 2001 From: Jover Lee Date: Wed, 21 Oct 2026 10:18:36 -0700 Subject: [PATCH 2/2] devel/setup-venv: Ensure we are using pip 26.2.2 --- devel/setup-venv | 3 +++ 1 file changed, 3 insertions(+) diff --git a/devel/setup-venv b/devel/setup-venv index b5233f22..d4034b4b 100755 --- a/devel/setup-venv +++ b/devel/setup-venv @@ -7,5 +7,8 @@ venv="$base/.venv" set -x rm -rf "$venv" python3 -m venv "$venv" +# Ensure that we are securely upgrading pip to 26.2.2 +# +"$venv"/bin/pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70" "$venv"/bin/pip install --upgrade pip setuptools wheel pip-tools "$venv"/bin/pip install -e '.[dev]'