From e4a9cbe2b89aa46e5366adfe5e5dfe75053bedb7 Mon Sep 17 00:00:00 2001 From: Elijah Goh Date: Wed, 4 Nov 2026 21:11:00 +0800 Subject: [PATCH] Bump dev lock to patched certifi, pytest and pytest-asyncio certifi 2026.7.22 bundles the emSign ECC Root CA - G3 with eight revoked eMudhra intermediate CA keys (GHSA-6q48-6c7w-9gw2). certifi is a runtime dependency of httpx, so SDK users installing with the dev extra inherit the vulnerable bundle. Move to 2026.10.23, the first release after the bundle update. pytest 8.4.2 uses predictable /tmp/pytest-of-{user} directories (GHSA-6w46-j5rx-g56g); 9.2.0 requires pytest-asyncio >= 1.4, so bump that to 1.4.0 as well. Audited by an automated dependency scan of the two SDK repositories; no other runtime-relevant advisories were found. Hashes verified against PyPI, and scripts/check.py passes end to end. --- requirements-dev.txt | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/requirements-dev.txt b/requirements-dev.txt index ab3aaff..009e659 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -13,9 +13,9 @@ attrs==26.1.0 \ build==1.3.0 \ --hash=sha256:698edd0ea270bde950f53aed21f3a0135672206f3911e0176261a31e0e07b397 \ --hash=sha256:7145f0b5061ba90a1500d60bd1b13ca0a8a4cebdd0cc16ed8adf1c0e739f43b4 -certifi==2026.7.22 \ - --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ - --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 +certifi==2026.10.23 \ + --hash=sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd \ + --hash=sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1 colorama==0.4.6 ; os_name == 'nt' or sys_platform == 'win32' \ --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \ --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6 @@ -320,12 +320,12 @@ pygments==2.21.0 \ pyproject-hooks==1.3.3 \ --hash=sha256:5fc53fdac9f7bd63fbcdc868fb5f90b4784d78a53a3d3388cd738b807441a20b \ --hash=sha256:defda19b854fa0d3bd4f76ea4ddcba8abd7dcfcdd585a6690ade050744fc5f43 -pytest==8.4.2 \ - --hash=sha256:86c0d0b93306b961d58d62a4db4879f27fe25513d4b969df351abdddb3c30e01 \ - --hash=sha256:872f880de3fc3a5bdc88a11b39c9710c3497a547cfa9320bc3c5e62fbf272e79 -pytest-asyncio==1.2.0 \ - --hash=sha256:8e17ae5e46d8e7efe51ab6494dd2010f4ca8dae51652aa3c8d55acf50bfb2e99 \ - --hash=sha256:c609a64a2a8768462d0c99811ddb8bd2583c33fd33cf7f21af1c142e824ffb57 +pytest==9.2.0 \ + --hash=sha256:07acdcf88ec174f907dc01af70bf52d49b014bbab03faeeade31c96b18c2e588 \ + --hash=sha256:97c4f3b1f3c7414aa36465e09b8220f1d03627993bd51b1282e193753c80557b +pytest-asyncio==1.4.0 \ + --hash=sha256:933ca923a23075a87fb7070c0ec272a6848489824d887c85c812670932835aa1 \ + --hash=sha256:c6c0d2259945122819f171a32ecea2c349ead889ee28176caaf492143424be42 python-dateutil==2.9.0.post0 \ --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \ --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427