Repository navigation
Update minium uv version to 0.13.4 to address untrustworthy intermediate CA - #75296
Conversation
…ate CA As mentioned in https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576, we should update to uv 0.13.4 to not trust an insecure/leaked intermediate CA This does require a 1 day old version, outside our normal 4 day or old dep policiy, which has been disabled for this specific version, and can be removed in a couple of days
boring-cyborg
Bot
added
area:airflow-ctl
area:dev-tools
area:production-image
Backport failed to create: v3-4-test. View the failure log Run detailsNote: As of Merging PRs targeted for Airflow 3.X In matter of doubt please ask in #release-management Slack channel.
You can attempt to backport this manually by running: cherry_picker c57e239 v3-4-testThis should apply the commit to the v3-4-test branch and leave the commit in conflict state marking After you have resolved the conflicts, you can continue the backport process by running: cherry_picker --continueIf you don't have cherry-picker installed, see the installation guide. |
Backport failed to create: airflow-ctl/v0-1-test. View the failure log Run detailsNote: As of Merging PRs targeted for Airflow 3.X In matter of doubt please ask in #release-management Slack channel.
You can attempt to backport this manually by running: cherry_picker c57e239 airflow-ctl/v0-1-testThis should apply the commit to the airflow-ctl/v0-1-test branch and leave the commit in conflict state marking After you have resolved the conflicts, you can continue the backport process by running: cherry_picker --continueIf you don't have cherry-picker installed, see the installation guide. |
|
I think this one broke the CI, not sure if uv 0.13.4 is allowed, so breeze is failing |
… - G3 certifi 2026.10.19 removes the emSign ECC Root CA - G3 root after the eMudhra CA compromise. It is inside the 4-day exclude-newer window, so add a temporary per-package cutoff to both [tool.uv.exclude-newer-package] and [tool.uv.pip.exclude-newer-package], following apache#75296, and relock certifi.
… - G3 (#75302) certifi 2026.10.19 removes the emSign ECC Root CA - G3 root after the eMudhra CA compromise. It is inside the 4-day exclude-newer window, so add a temporary per-package cutoff to both [tool.uv.exclude-newer-package] and [tool.uv.pip.exclude-newer-package], following #75296, and relock certifi.
AIRFLOW_UV_VERSION in release_management_commands.py was left at 0.13.1 when the minimum uv version was raised to 0.13.4 in #75296.
… ECC Root CA - G3 (#75302) (#75312) certifi 2026.10.19 removes the emSign ECC Root CA - G3 root after the eMudhra CA compromise. It is inside the 4-day exclude-newer window, so add a temporary per-package cutoff to both [tool.uv.exclude-newer-package] and [tool.uv.pip.exclude-newer-package], following #75296, and relock certifi. (cherry picked from commit 7e0c1ac) Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com>
As mentioned in https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576,
we should update to uv 0.13.4 to not trust an insecure/leaked intermediate CA
This does require a 1 day old version, outside our normal 4 day or old dep
policiy, which has been disabled for this specific version, and can be removed
in a couple of days
Was generative AI tooling used to co-author this PR?
{pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.