From 0304f34f6abdeddc768d098356a84d85cacafa01 Mon Sep 17 00:00:00 2001 From: Joon-Yee Chuah Date: Thu, 22 Oct 2026 16:14:51 -0500 Subject: [PATCH 1/3] =?UTF-8?q?security:=20eMudhra/emSign=20CA=20=E2=80=94?= =?UTF-8?q?=20cibuildwheel=204.3.4=20in=20the=20release=20workflow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Eight eMudhra (emSign) intermediate CA keys are compromised. pip always loads its vendored certifi, so pinned certifi/pip/uv must move to fixed versions and python:* images must upgrade pip explicitly. Advisory: https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 Co-Authored-By: Claude Fable 5.1 --- .github/workflows/release-to-pypi.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-to-pypi.yml b/.github/workflows/release-to-pypi.yml index 450d93c6a..4029cdd44 100644 --- a/.github/workflows/release-to-pypi.yml +++ b/.github/workflows/release-to-pypi.yml @@ -33,7 +33,7 @@ jobs: run: python -m pip install twine - name: Build wheels - uses: pypa/cibuildwheel@v3.2.1 + uses: pypa/cibuildwheel@v4.3.4 - name: Check and upload wheels if: ${{ github.event_name == 'release' }} From 836adadab6bccaf07072d047f586a3d275f00735 Mon Sep 17 00:00:00 2001 From: Joon-Yee Chuah Date: Mon, 26 Oct 2026 10:29:09 -0500 Subject: [PATCH 2/3] =?UTF-8?q?security:=20eMudhra/emSign=20CA=20=E2=80=94?= =?UTF-8?q?=20EDM=20client=204.1.7?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit EDM verifies its connection to EDS against the CA bundle inside the installer; every release through 4.1.6 ships a pre-incident bundle. 4.1.7 (2026-10-23) carries certifi 2026.10.19. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/ets-from-source.yml | 6 +++--- .github/workflows/test-with-edm.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ets-from-source.yml b/.github/workflows/ets-from-source.yml index acb3e7cef..37bc78d2f 100644 --- a/.github/workflows/ets-from-source.yml +++ b/.github/workflows/ets-from-source.yml @@ -8,7 +8,7 @@ on: - cron: '0 0 * * 5' env: - INSTALL_EDM_VERSION: 3.2.3 + INSTALL_EDM_VERSION: 4.1.7 jobs: @@ -30,7 +30,7 @@ jobs: path: ~/.cache key: ${{ runner.os }}-${{ matrix.toolkit }}-${{ hashFiles('ci/edmtool.py') }} - name: Set up EDM - uses: enthought/setup-edm-action@v2 + uses: enthought/setup-edm-action@v4.2 with: edm-version: ${{ env.INSTALL_EDM_VERSION }} - name: Install click to the default EDM environment @@ -57,7 +57,7 @@ jobs: path: ~/.cache key: ${{ runner.os }}-${{ matrix.toolkit }}-${{ hashFiles('ci/edmtool.py') }} - name: Setup EDM - uses: enthought/setup-edm-action@v2 + uses: enthought/setup-edm-action@v4.2 with: edm-version: ${{ env.INSTALL_EDM_VERSION }} - name: Install click to the default EDM environment diff --git a/.github/workflows/test-with-edm.yml b/.github/workflows/test-with-edm.yml index 19d06f6af..a8647add3 100644 --- a/.github/workflows/test-with-edm.yml +++ b/.github/workflows/test-with-edm.yml @@ -7,7 +7,7 @@ name: Test with EDM on: pull_request env: - INSTALL_EDM_VERSION: 4.1.1 + INSTALL_EDM_VERSION: 4.1.7 PYTHONUNBUFFERED: 1 EDM_CONFIG: '${{ github.workspace }}/ci/edm.yaml' From 47fcad0b9232739936668a9499b6ee464f4ded86 Mon Sep 17 00:00:00 2001 From: Joon-Yee Chuah Date: Mon, 26 Oct 2026 10:44:04 -0500 Subject: [PATCH 3/3] ci: keep the macOS EDM leg on the last EDM with a macOS installer No macOS build of EDM 4.1.7 exists; the osx_x86_64 4.1 path returns 403. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/test-with-edm.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test-with-edm.yml b/.github/workflows/test-with-edm.yml index a8647add3..c11d8c07b 100644 --- a/.github/workflows/test-with-edm.yml +++ b/.github/workflows/test-with-edm.yml @@ -8,6 +8,8 @@ on: pull_request env: INSTALL_EDM_VERSION: 4.1.7 + # No macOS build of EDM 4.1.7 exists (EDM is supported on Linux and Windows); macOS keeps the last version that has one. + INSTALL_EDM_VERSION_MACOS: 4.1.1 PYTHONUNBUFFERED: 1 EDM_CONFIG: '${{ github.workspace }}/ci/edm.yaml' @@ -37,7 +39,7 @@ jobs: - name: Setup EDM uses: enthought/setup-edm-action@v4.1 with: - edm-version: ${{ env.INSTALL_EDM_VERSION }} + edm-version: ${{ runner.os == 'macOS' && env.INSTALL_EDM_VERSION_MACOS || env.INSTALL_EDM_VERSION }} - name: Install opengl for Linux run: | sudo apt-get update