From 7d8f2260ffacad8a9dd81a4c4395306758fc6662 Mon Sep 17 00:00:00 2001
From: Leechael Yim <yanleech@gmail.com>
Date: Thu, 22 Oct 2026 08:16:24 +0800
Subject: [PATCH] fix(sdk): pick up the emSign CA fixes in the Rust and Python
 SDK locks

Rust SDK: reqwest 0.12 with rustls-tls uses the roots compiled in from
webpki-roots. The lock had webpki-roots 1.0.8 and rustls-webpki
0.103.15, and that combination accepts a certificate issued by one of
the compromised eMudhra/emSign intermediate CAs. Move rustls-webpki to
0.103.16 (RUSTSEC-2026-0383, CVE-2026-111943), which rejects chains with
those keys, and webpki-roots to 1.0.10.

Python SDK: httpx uses certifi by default. The lock had certifi
2025.8.3, which still holds emSign ECC Root CA - G3. Move it to
2026.10.19 and add certifi>=2026.10.19 to the dependencies, so
installs outside the lock also get a fixed bundle. pdm 2.29 rewrote
lock_version from 4.5.0 to 4.5.1.

Both SDKs are libraries: applications that depend on them resolve their
own versions, so they need to update their locks too.

Signed-off-by: Leechael Yim <yanleech@gmail.com>
---
 sdk/python/pdm.lock       | 10 +++++-----
 sdk/python/pyproject.toml |  1 +
 sdk/rust/Cargo.lock       |  8 ++++----
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/sdk/python/pdm.lock b/sdk/python/pdm.lock
index 3ffaff90c..325940f42 100644
--- a/sdk/python/pdm.lock
+++ b/sdk/python/pdm.lock
@@ -4,8 +4,8 @@
 [metadata]
 groups = ["default", "dev", "ethereum", "lint", "solana"]
 strategy = ["inherit_metadata"]
-lock_version = "4.5.0"
-content_hash = "sha256:9f51ba70b678858ab30777d25d4596d2ad8101438269cd2a4be5b2325eaa6c9b"
+lock_version = "4.5.1"
+content_hash = "sha256:1385af9667052c21cb40fd49db74325b2cb096680c162be549795a89e44c64c0"
 
 [[metadata.targets]]
 requires_python = ">=3.10"
@@ -137,13 +137,13 @@ files = [
 
 [[package]]
 name = "certifi"
-version = "2025.8.3"
+version = "2026.10.19"
 requires_python = ">=3.7"
 summary = "Python package for providing Mozilla's CA Bundle."
 groups = ["default"]
 files = [
-    {file = "certifi-2025.8.3-py3-none-any.whl", hash = "sha256:f6c12493cfb1b06ba2ff328595af9350c65d6644968e5d3a2ffd78699af217a5"},
-    {file = "certifi-2025.8.3.tar.gz", hash = "sha256:e564105f78ded564e3ae7c923924435e1daa7463faeab5bb932bc53ffae63407"},
+    {file = "certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b"},
+    {file = "certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae"},
 ]
 
 [[package]]
diff --git a/sdk/python/pyproject.toml b/sdk/python/pyproject.toml
index d67994ef7..05d209568 100644
--- a/sdk/python/pyproject.toml
+++ b/sdk/python/pyproject.toml
@@ -12,6 +12,7 @@ authors = [
 ]
 dependencies = [
     "httpx>=0.27.2",
+    "certifi>=2026.10.19",
     "asyncio>=3.4.3",
     "pydantic>=2.9.2",
     "cryptography>=43.0.0",
diff --git a/sdk/rust/Cargo.lock b/sdk/rust/Cargo.lock
index 093f37548..76e77079b 100644
--- a/sdk/rust/Cargo.lock
+++ b/sdk/rust/Cargo.lock
@@ -3438,9 +3438,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -4391,9 +4391,9 @@ dependencies = [
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.8"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
+checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
 dependencies = [
  "rustls-pki-types",
 ]