From 7afac06b0d46657a9b629f184b6cf85b0eb8fbbe Mon Sep 17 00:00:00 2001 From: Ondrej Drapalik Date: Fri, 23 Oct 2026 22:16:10 +0200 Subject: [PATCH 1/2] chore(deps): bump certifi to 2026.10.19 --- .changeset/certifi-dev-lock.md | 6 ++++++ packages/claude-toolsets-python/pyproject.toml | 3 ++- packages/claude-toolsets-python/uv.lock | 7 ++++--- 3 files changed, 12 insertions(+), 4 deletions(-) create mode 100644 .changeset/certifi-dev-lock.md diff --git a/.changeset/certifi-dev-lock.md b/.changeset/certifi-dev-lock.md new file mode 100644 index 0000000..2ffb112 --- /dev/null +++ b/.changeset/certifi-dev-lock.md @@ -0,0 +1,6 @@ +--- +"@e2b/claude-toolsets": patch +"@e2b/claude-toolsets-python": patch +--- + +Lock certifi 2026.10.19 in the Python package's development and build environment, the release that drops the compromised eMudhra intermediates. This updates the locked build and test environment; installed packages still use whatever certifi and certificate stores the user's environment provides. diff --git a/packages/claude-toolsets-python/pyproject.toml b/packages/claude-toolsets-python/pyproject.toml index 472aa3a..b2aa441 100644 --- a/packages/claude-toolsets-python/pyproject.toml +++ b/packages/claude-toolsets-python/pyproject.toml @@ -24,7 +24,8 @@ include = ["e2b_claude_toolsets", "pyproject.toml", "hatch_build.py", "README.md [tool.uv] exclude-newer = "7 days" # anthropic 1.12.0 is the first release with the toolset helpers (2026-10-07); exempt it from the 7-day guard. -exclude-newer-package = { anthropic = "2026-10-07T18:30:59Z" } +# certifi 2026.10.19 (2026-10-20) is the eMudhra-patched trust store: https://emudhra.we-have-a-problem.com/ +exclude-newer-package = { anthropic = "2026-10-07T18:30:59Z", certifi = "2026-10-20T02:24:17Z" } [tool.ruff] line-length = 120 diff --git a/packages/claude-toolsets-python/uv.lock b/packages/claude-toolsets-python/uv.lock index a97e49f..b162661 100644 --- a/packages/claude-toolsets-python/uv.lock +++ b/packages/claude-toolsets-python/uv.lock @@ -12,6 +12,7 @@ exclude-newer-span = "P7D" [options.exclude-newer-package] anthropic = "2026-10-07T18:30:59Z" +certifi = "2026-10-20T02:24:17Z" [[package]] name = "annotated-types" @@ -90,11 +91,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.7.22" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]] From 3800541a795d3e37cbb627978f339320281b4980 Mon Sep 17 00:00:00 2001 From: Ondrej Drapalik Date: Fri, 23 Oct 2026 22:21:45 +0200 Subject: [PATCH 2/2] chore(deps): give certifi a rolling 3-day window instead of a fixed cutoff --- packages/claude-toolsets-python/pyproject.toml | 5 +++-- packages/claude-toolsets-python/uv.lock | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/packages/claude-toolsets-python/pyproject.toml b/packages/claude-toolsets-python/pyproject.toml index b2aa441..0f7c128 100644 --- a/packages/claude-toolsets-python/pyproject.toml +++ b/packages/claude-toolsets-python/pyproject.toml @@ -24,8 +24,9 @@ include = ["e2b_claude_toolsets", "pyproject.toml", "hatch_build.py", "README.md [tool.uv] exclude-newer = "7 days" # anthropic 1.12.0 is the first release with the toolset helpers (2026-10-07); exempt it from the 7-day guard. -# certifi 2026.10.19 (2026-10-20) is the eMudhra-patched trust store: https://emudhra.we-have-a-problem.com/ -exclude-newer-package = { anthropic = "2026-10-07T18:30:59Z", certifi = "2026-10-20T02:24:17Z" } +# certifi gets a shorter rolling window so CA-distrust releases land sooner; 2026.10.19 drops the +# compromised emSign roots (https://github.com/certifi/python-certifi/pull/437). +exclude-newer-package = { anthropic = "2026-10-07T18:30:59Z", certifi = "3 days" } [tool.ruff] line-length = 120 diff --git a/packages/claude-toolsets-python/uv.lock b/packages/claude-toolsets-python/uv.lock index b162661..e08c760 100644 --- a/packages/claude-toolsets-python/uv.lock +++ b/packages/claude-toolsets-python/uv.lock @@ -12,7 +12,7 @@ exclude-newer-span = "P7D" [options.exclude-newer-package] anthropic = "2026-10-07T18:30:59Z" -certifi = "2026-10-20T02:24:17Z" +certifi = { timestamp = "0001-01-01T00:00:00Z", span = "P3D" } [[package]] name = "annotated-types"