From bb3d0678baba30cfd9a74a6c2d294b8e51bb17e2 Mon Sep 17 00:00:00 2001 From: Esteban Gutierrez Date: Wed, 21 Oct 2026 12:53:05 -0500 Subject: [PATCH 1/5] fix: update trust-store pins for the eMudhra CA compromise Cargo.lock: webpki-roots and webpki-root-certs 1.0.10, rustls-webpki 0.103.16. python/Cargo.lock and java/lance-jni/Cargo.lock: webpki-root- certs 1.0.10 and rustls-webpki 0.103.16; python/uv.lock: certifi 2026.10.18, The Cargo locks change the webpki entries only. The root crates drop emSign ECC Root CA - G3 and certifi 2026.10.18 holds no emSign root; rustls- webpki 0.103.16 rejects chains that carry the compromised eMudhra intermediate keys. webpki-roots 1.0.10 also carries the 1.0.9 Mozilla store changes (Telia EC and RSA TLS Root CA v3 and SECOM TLS ECC and RSA Root CA 2024 added, Atos TrustedRoot 2011 removed); relative to the previous 2026.6.17 pin, certifi 2026.10.18 adds the same four roots and drops Atos TrustedRoot 2011 and the four emSign roots. Co-authored-by: Claude Opus 5.1 --- Cargo.lock | 14 +++++++------- java/lance-jni/Cargo.lock | 8 ++++---- python/Cargo.lock | 8 ++++---- python/uv.lock | 6 +++--- 4 files changed, 18 insertions(+), 18 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 473d75c6004..25c6e4f6bad 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -8142,9 +8142,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -10038,9 +10038,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.8" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] @@ -10051,14 +10051,14 @@ version = "0.26.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" dependencies = [ - "webpki-roots 1.0.8", + "webpki-roots 1.0.10", ] [[package]] name = "webpki-roots" -version = "1.0.8" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] diff --git a/java/lance-jni/Cargo.lock b/java/lance-jni/Cargo.lock index 410f39c284f..3d899d69204 100644 --- a/java/lance-jni/Cargo.lock +++ b/java/lance-jni/Cargo.lock @@ -6781,9 +6781,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -8343,9 +8343,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.8" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] diff --git a/python/Cargo.lock b/python/Cargo.lock index f5dad30ec89..61ad226e3c8 100644 --- a/python/Cargo.lock +++ b/python/Cargo.lock @@ -7170,9 +7170,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -8806,9 +8806,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.8" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] diff --git a/python/uv.lock b/python/uv.lock index 1bfeb19537d..65c8273cbc9 100644 --- a/python/uv.lock +++ b/python/uv.lock @@ -316,11 +316,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.6.17" +version = "2026.10.18" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/c9/c7/424b75da314c1045981bd9777432fad05a9e0c69daa4ed7e308bbaffe405/certifi-2026.6.17.tar.gz", hash = "sha256:024c88eeec92ca068db80f02b8b07c9cef7b9fe261d1d535abfd5abd6f6af432", size = 134594, upload-time = "2026-06-17T10:31:07.894Z" } +sdist = { url = "https://files.pythonhosted.org/packages/7e/eb/a2aa1ac3ea30dd3f30ca57f40232138b6b0040719316ecb85daf61167771/certifi-2026.10.18.tar.gz", hash = "sha256:b9995d97b64d0431a5af837d8ca8cd6238104d1f319f04bd93ea43124d6c861e", size = 135227, upload-time = "2026-10-18T16:21:07.655Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/ef/2f/c5464532e965badff2f4c4c1a3a83f5697f0d7c407ed0cda44aaa99bb451/certifi-2026.6.17-py3-none-any.whl", hash = "sha256:2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db", size = 133289, upload-time = "2026-06-17T10:31:06.348Z" }, + { url = "https://files.pythonhosted.org/packages/08/ba/95dd616042484f7c83a06974388b37b837732740ee70bc5dc715b5fcd55a/certifi-2026.10.18-py3-none-any.whl", hash = "sha256:73191c47aaa79da394e8fee2dbc2ec827432cab56311122c9e47abf79e390f62", size = 134093, upload-time = "2026-10-18T16:21:06.276Z" }, ] [[package]] From 87d8e76ce71f1951e7347f08570760badb24ff4a Mon Sep 17 00:00:00 2001 From: Esteban Gutierrez Date: Wed, 21 Oct 2026 14:23:13 -0500 Subject: [PATCH 2/5] ci: allow the trust-store crates through the dependency age gate rustls-webpki 0.103.16, webpki-roots 1.0.10 and webpki-root-certs 1.0.10 were published less than 48 hours before this change. They carry the eMudhra intermediate distrust (RUSTSEC-2026-0382 / CVE-2026-111943), so the fix cannot wait for the floor. The entries become inert once the versions pass it. Co-authored-by: Claude Opus 5.1 --- ci/dependency-age-allowlist.toml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/ci/dependency-age-allowlist.toml b/ci/dependency-age-allowlist.toml index 60866509a4e..6b7c1c34273 100644 --- a/ci/dependency-age-allowlist.toml +++ b/ci/dependency-age-allowlist.toml @@ -13,3 +13,18 @@ # crate = "some-crate" # version = "1.2.3" # reason = "RUSTSEC-2026-0000, allowlisted in Aikido 2026-09-16" + +[[allow]] +crate = "rustls-webpki" +version = "0.103.16" +reason = "RUSTSEC-2026-0382 / CVE-2026-111943: rejects chains that carry the compromised eMudhra intermediate keys; Aikido still serves an index without this version to developer machines as of 2026-10-21" + +[[allow]] +crate = "webpki-roots" +version = "1.0.10" +reason = "drops emSign ECC Root CA - G3 after the eMudhra intermediate compromise; Aikido still serves an index without this version to developer machines as of 2026-10-21" + +[[allow]] +crate = "webpki-root-certs" +version = "1.0.10" +reason = "drops emSign ECC Root CA - G3 after the eMudhra intermediate compromise; Aikido still serves an index without this version to developer machines as of 2026-10-21" From 6c5c5569e5e6b7647f72a38fb32b53db406b7eaf Mon Sep 17 00:00:00 2001 From: Esteban Gutierrez Date: Wed, 21 Oct 2026 14:24:04 -0500 Subject: [PATCH 3/5] ci: date the dependency-age exemptions Each reason now ends with the time the version clears the 48-hour floor, so the entry can be removed after it. Co-authored-by: Claude Opus 5.1 --- ci/dependency-age-allowlist.toml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ci/dependency-age-allowlist.toml b/ci/dependency-age-allowlist.toml index 6b7c1c34273..8404443e309 100644 --- a/ci/dependency-age-allowlist.toml +++ b/ci/dependency-age-allowlist.toml @@ -17,14 +17,14 @@ [[allow]] crate = "rustls-webpki" version = "0.103.16" -reason = "RUSTSEC-2026-0382 / CVE-2026-111943: rejects chains that carry the compromised eMudhra intermediate keys; Aikido still serves an index without this version to developer machines as of 2026-10-21" +reason = "RUSTSEC-2026-0382 / CVE-2026-111943: rejects chains that carry the compromised eMudhra intermediate keys; remove after 2026-10-22T08:58Z" [[allow]] crate = "webpki-roots" version = "1.0.10" -reason = "drops emSign ECC Root CA - G3 after the eMudhra intermediate compromise; Aikido still serves an index without this version to developer machines as of 2026-10-21" +reason = "drops emSign ECC Root CA - G3 after the eMudhra intermediate compromise; remove after 2026-10-21T20:11Z" [[allow]] crate = "webpki-root-certs" version = "1.0.10" -reason = "drops emSign ECC Root CA - G3 after the eMudhra intermediate compromise; Aikido still serves an index without this version to developer machines as of 2026-10-21" +reason = "drops emSign ECC Root CA - G3 after the eMudhra intermediate compromise; remove after 2026-10-21T20:11Z" From eaa549a967db31b8c8b9c47eacc02cd0c5c5ffc6 Mon Sep 17 00:00:00 2001 From: Esteban Gutierrez Date: Wed, 21 Oct 2026 14:46:05 -0500 Subject: [PATCH 4/5] fix(python): move certifi to 2026.10.19 2026.10.19 is the release the certifi advisory names as fixed. It drops only the distrusted root and keeps the same issuer's other roots, so HTTPS connections that chain to them keep working. The lock changes the certifi entry only. Co-authored-by: Claude Opus 5.1 --- python/uv.lock | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/python/uv.lock b/python/uv.lock index 65c8273cbc9..54a9b1235b1 100644 --- a/python/uv.lock +++ b/python/uv.lock @@ -316,13 +316,12 @@ wheels = [ [[package]] name = "certifi" -version = "2026.10.18" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/7e/eb/a2aa1ac3ea30dd3f30ca57f40232138b6b0040719316ecb85daf61167771/certifi-2026.10.18.tar.gz", hash = "sha256:b9995d97b64d0431a5af837d8ca8cd6238104d1f319f04bd93ea43124d6c861e", size = 135227, upload-time = "2026-10-18T16:21:07.655Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/08/ba/95dd616042484f7c83a06974388b37b837732740ee70bc5dc715b5fcd55a/certifi-2026.10.18-py3-none-any.whl", hash = "sha256:73191c47aaa79da394e8fee2dbc2ec827432cab56311122c9e47abf79e390f62", size = 134093, upload-time = "2026-10-18T16:21:06.276Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] - [[package]] name = "charset-normalizer" version = "3.4.9" From a22d3291dd2a368117fee6a8450fdac451a20524 Mon Sep 17 00:00:00 2001 From: Esteban Gutierrez Date: Wed, 21 Oct 2026 14:47:02 -0500 Subject: [PATCH 5/5] style(python): restore the blank line between lock entries Co-authored-by: Claude Opus 5.1 --- python/uv.lock | 1 + 1 file changed, 1 insertion(+) diff --git a/python/uv.lock b/python/uv.lock index 54a9b1235b1..a269af25469 100644 --- a/python/uv.lock +++ b/python/uv.lock @@ -322,6 +322,7 @@ sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0 wheels = [ { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] + [[package]] name = "charset-normalizer" version = "3.4.9"