[misc] fix: require patched certifi and uv trust stores

Merged
JO
5d ago
+89-30

What

  • Require certifi>=2026.10.19 in the base dependencies, where HTTPX uses its CA bundle.
  • Require uv>=0.13.4,<0.14 in both Harbor and eval extras; the previous <0.13 ceiling excluded the patched bundled trust store.
  • Refresh uv.lock to certifi 2026.10.19 and uv 0.13.4. No other package versions or sources change; uv 0.13.4 also writes lock revision 5.
  • Extend dependency-security regressions and the isolated wheel verifier to check ownership, vulnerable-version exclusion, admission of the patched releases, locked versions, and installed versions.

Why

GHSA-6q48-6c7w-9gw2 affects certifi >=2019.03.09,<2026.10.19; the reviewed fix is 2026.10.19. That release retains unaffected emSign roots while removing the affected root. GHSA-hq85-5cpj-mr62 independently affects uv's bundled CA store before 0.13.4; updating certifi alone does not fix it. Related repository alerts: 143, 144.

Reviewed uv 0.13 compatibility changes and 0.13.1–0.13.4 changes. Existing compatible Python installations remain usable; automatic downloads without a version pin can now choose Python 3.15, so rollout projects needing a specific version should retain their Python pin. The SDK does not use the changed requirements-file options or uv build --clear. Real wheel builds and the SDK's actual uv sync/run commands passed with 0.13.4, including fresh Python 3.12 environments and the new archive/venv behavior. The upper bound stays below the next minor release.

This remediates repository dependency declarations and resolution. It is not evidence of exploitation, does not update deployed environments, and does not establish that Dependabot alerts have closed.

How to Test

Validation used uv 0.13.4 and Python 3.13.15 unless noted:

  • uv sync --locked --all-extras --group dev --python 3.13, uv lock --check --offline, and uv pip check: passed.
  • uv run --no-sync pytest tests/unit/test_dependency_security.py tests/unit/test_public_api_imports.py::test_extra_modules_table_matches_pyproject_extras tests/unit/test_uv.py tests/unit/test_packaging.py tests/unit/eval/local/test_runner_units.py -q --tb=short: 177 passed, including actual Harbor bundle wheel builds.
  • uv run --no-sync pytest -n 2 --dist worksteal --tb=short -q: 3732 passed, 1 skipped.
  • uv run --no-sync ruff check ., uv run --no-sync ruff format --check ., and uv run --no-sync ty check --error-on-warning osmosis_ai/: passed.
  • uv run --no-editable pyright --verifytypes osmosis_ai --ignoreexternal: 100% type completeness; exit 1 contains only the two documented harbor.harness_agent.OsmosisHarnessInstalledAgent baseline errors.
  • uv build --python 3.12, uvx twine check --strict dist/*, and python3.12 .github/scripts/verify-public-artifacts.py dist/*.whl dist/*.tar.gz: passed.
  • All nine Python 3.12 isolated wheel-smoke scenarios from .github/workflows/tests.yml passed, including uv pip check and python -I .github/scripts/verify-wheel-install.py.
  • Verified osmosis_ai._uv._uv_executable() selects the SDK environment's .venv/bin/uv 0.13.4, then executed the local-eval uv_sync_command, uv_sdk_version_command, and uv_run_command against a temporary rollout project: sync, installed-SDK version probe, bootstrap, and health-marker assertions passed.
  • The installed certifi bundle excludes emSign ECC Root CA - G3, retains emSign Root CA - G1, and loads successfully into an SSL context.
  • git diff --check and commit hooks: passed.

GitHub Tests run 39529401318 passed all 17 jobs for head 559137475f5ff3f33e190d0d833f6bb0c56e24b0: Python 3.12/3.13/3.14 suites, 91.57% coverage on Python 3.12, lint, types, build, both Harbor compatibility scenarios, and all nine wheel-smoke scenarios. PR title validation also passed. Remote sandbox execution and deployed images were not exercised.

Checklist

  • PR title follows [module] type: description format (labels are derived from it automatically — no need to add them by hand)
  • ruff check . and ruff format --check . pass
  • ty check --error-on-warning osmosis_ai/ passes; uv run --no-editable pyright --verifytypes osmosis_ai --ignoreexternal has no unexpected errors (see CONTRIBUTING.md for the Harbor baseline)
  • pytest passes (new tests added if applicable)
  • Public API changes are documented
  • No secrets or credentials included

Devin Review