Repository navigation
ENG-13482: our images and HTTP clients trust TLS certificates forged with eMudhra's crackable CA keys - #7627
Darksinian wants to merge 1 commit into
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e7bdbd10d7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| reflex-enterprise = false | ||
| reflex-hosting-cli = false | ||
| # 2026.10.19 drops the emSign ECC Root CA - G3 root, whose intermediates have crackable keys. | ||
| certifi = false |
There was a problem hiding this comment.
This setting only changes uv's local lockfile resolution and is not included in the published Reflex wheel metadata. When a user upgrades Reflex in an environment that already has an older certifi, the unbounded transitive requirement from httpx remains satisfied, so pip can leave the vulnerable CA bundle installed and the stated TLS fix never reaches that user. Add a certifi >=2026.10.19 runtime dependency (or an equivalent published constraint), rather than only exempting certifi from exclude-newer.
Useful? React with 👍 / 👎.
 [High impact] This PR appears safe to merge. SummaryUpdates
Reviews (1) · Last reviewed commit: "Bump certifi to 2026.10.19 to drop the e..." · Reviewed by Greptile |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 3 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="pyproject.toml">
<violation number="1" location="pyproject.toml:563">
P1: `certifi = false` only bypasses uv’s resolver cutoff; it does not add a runtime requirement to published Reflex metadata. Pip installations can therefore retain vulnerable certifi versions despite the updated lock. Add `certifi >=2026.10.19` to `[project].dependencies`, while retaining this override for lock resolution.</violation>
</file>
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
| reflex-enterprise = false | ||
| reflex-hosting-cli = false | ||
| # 2026.10.19 drops the emSign ECC Root CA - G3 root, whose intermediates have crackable keys. | ||
| certifi = false |
There was a problem hiding this comment.
P1: certifi = false only bypasses uv’s resolver cutoff; it does not add a runtime requirement to published Reflex metadata. Pip installations can therefore retain vulnerable certifi versions despite the updated lock. Add certifi >=2026.10.19 to [project].dependencies, while retaining this override for lock resolution.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At pyproject.toml, line 563:
<comment>`certifi = false` only bypasses uv’s resolver cutoff; it does not add a runtime requirement to published Reflex metadata. Pip installations can therefore retain vulnerable certifi versions despite the updated lock. Add `certifi >=2026.10.19` to `[project].dependencies`, while retaining this override for lock resolution.</comment>
<file context>
@@ -559,6 +559,8 @@ reflex-components-recharts = false
reflex-enterprise = false
reflex-hosting-cli = false
+# 2026.10.19 drops the emSign ECC Root CA - G3 root, whose intermediates have crackable keys.
+certifi = false
[tool.uv.sources]
</file context>
Merging this PR will not alter performance1 warning
Comparing 
|
|
going to take #7628 instead, which also updates pillow dep |
Darksinian
changed the title
Uh oh!
There was an error while loading. Please reload this page.