fix(deps): pin certifi to 2026.10.19

Merged
ON
1d ago
+15-15

Pins certifi to 2026.10.19 in every manifest and lockfile for PYSEC-2026-4320. Opened by the CVE Alerts run.

Closes #16334

PYSEC-2026-4320 (GHSA-6q48-6c7w-9gw2) is a trust-store problem, not a code bug. certifi before 2026.10.19 ships the emSign ECC Root CA - G3 root, and eight intermediates under it have leaked private keys. Anyone holding one of those keys who can also intercept traffic can pose as any HTTPS server to a client that trusts the bundle. The fix is to lock certifi at 2026.10.19, which is on the same date-based version line as the current 2025.11.12. I read the root pyproject.toml, tools/ods/pyproject.toml and cli/pyproject.toml and none of them pin certifi; it comes in only through uv.lock as a dependency of other packages, so I edited no files. I had no search tool, so I could not check the whole repo for other pins or for code that points TLS at a different CA bundle. I am calling Onyx affected because the backend makes many outbound HTTPS calls (LLM providers, connectors, webhooks) through requests, httpx and urllib3, which use the certifi bundle by default. An attack still needs both a leaked key and a network position, and images built from the old lock need rebuilding to pick up the fix.

Summary by cubic

Pins certifi to 2026.10.19 in the backend requirement files and uv.lock to fix PYSEC-2026-4320, a trust-store vulnerability.

  • certifi before 2026.10.19 ships the emSign ECC Root CA - G3 root, and eight intermediates under it have leaked private keys.
  • An attacker holding a leaked key who can intercept traffic can pose as any HTTPS server to clients trusting that bundle.
  • Images built from the old lock need rebuilding so the backend's outbound HTTPS calls (LLM providers, connectors, webhooks) pick up the new bundle.

Summary by CodeRabbit

  • Chores
    • Updated the bundled certificate authority package to version 2026.10.19 across supported deployment and development environments.
    • Refreshed package integrity checks to match the updated release.