New security notice from pypi.org

Show and Tell
1

Information for Python users regarding eMudhra / emSign CA certificate security incident - Packaging / Announcements - Discussions on Python.org

For questions, please see the above link, as it is being updated by the experts.

1 Like
2

@meredydd Have the Anvil runtimes been patched? I see that the 3.14 runtime is still on 3.14.8. Security releases were published last week: Python 3.15.1, 3.14.9 and 3.13.17 are out - Core Development - Discussions on Python.org.

1 Like
3

My app runs on hosted Anvil, and I’ve updated its certifi requirement to 2026.10.23. A few questions about the platform side that I can’t check from my app:

  1. Has the hosted server runtime’s CA trust store been updated to remove the compromised eMudhra/emSign roots? Which source does it use: certifi, the OS ca-certificates package, or something else?
  2. What trust store does anvil.http.request use for outbound HTTPS? Does my pinned certifi version affect it, or only libraries like requests and httpx?
  3. When Anvil builds a server environment from my requirements, which pip version does it use? Versions before 26.2.2 always trust their own vendored certifi, regardless of the OS store.

Is there an official status or announcement I should follow?

Thanks!