[Aikido] Fix critical issue in pypa/gh-action-pypi-publish via minor version upgrade from 1.13.0 to 1.14.3 in .github
Draft
AI
2d ago+1+1+0123456789-1-1-0123456789
Upgrade pypi-publish to remove compromised emSign root CA certificate from certifi bundle, preventing potential man-in-the-middle attacks on PyPI publishing.
✅ 1 CVE resolved by this upgrade, including 1 critical 🚨 CVE
This PR will resolve the following CVEs:
| Issue | Severity | Description |
|---|---|---|
GHSA-5xjx-3w67-w9x9 | 🚨 CRITICAL | [pypa/gh-action-pypi-publish] A removed root CA certificate from the bundled trust store breaks TLS verification for Sigstore, compromising Trusted Publishing and Digital Attestations functionality. This could allow man-in-the-middle attacks or prevent secure package publishing operations. |