[Other] Bump certifi to 2026.10.19: the 2026.7.22 pin trusts the compromised eMudhra root
Maintainers usually reply within 3 days
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 88/100
Research direction
Open requirements.txt and confirm the current certifi pin. Update it to certifi==2026.10.19, then install the requirements and start the server to check that it responds to API requests; the issue reports this was tested on Linux with CUDA and Python 3.14. Done when the requirements pin uses the specified certifi release and the server starts and answers requests.
Written by the indexing model from the issue text.
Description
requirements.txt pins certifi==2026.7.22. That bundle includes "emSign ECC Root CA - G3". The private keys of eight eMudhra intermediate CAs below that root were found to be recoverable (disclosed 2026-10-17). Mozilla, Google and Apple have blocked the intermediates and distrusted the root. certifi 2026.10.19 removes the root.
Proposed change: certifi==2026.10.19. Tested on Linux, CUDA, Python 3.14: the server starts and answers API requests with the new pin.
References:
- Dominant language
- C++
- Stars
- 11.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Niko1221/Strata
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Niko1221/Strata#3785 · 2 comments ·
Maintainers usually reply within 3 days
-
Difficulty 1/5 Under an hour Newbie friendliness 75/100
Maintainers usually reply within 3 days
-
Difficulty 1/5 Under an hour Newbie friendliness 82/100
Maintainers usually reply within 3 days
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
Maintainers usually reply within 3 days
Similar issues
-
Eval bug: minimax-m3: build_moe_ffn() drops the per-expert NVFP4 scale → garbled output (M3.1 Flash)Openbug-unconfirmed
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Status: Needs confirmation Status: Needs triage
Difficulty 1/5 Under an hour Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
[BUG] Failed archive extraction deletes the dataset cachePossibly taken @dajiaohuang claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
alibaba/GraphScope#4674 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 93/100
webarkit/WebARKitLib#107 ·
Maintainers usually reply within 1 day