From d3446c4c105d24a7ec9a7dfd9a825de0fc003012 Mon Sep 17 00:00:00 2001 From: Jay Sobel Date: Tue, 20 Oct 2026 14:39:36 -0700 Subject: [PATCH] Require patched CA bundle for Python clients --- .github/workflows/ci.yml | 2 ++ README.md | 6 ++++++ pyproject.toml | 3 ++- src/colacloud/_version.py | 2 +- 4 files changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bc744c5..7e31a8e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -32,6 +32,8 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v8.1.0 + with: + version: "0.13.4" - name: Install dependencies run: uv sync --all-extras diff --git a/README.md b/README.md index 7e108a6..f79a69f 100644 --- a/README.md +++ b/README.md @@ -381,3 +381,9 @@ name explicitly marked “Used on label” in the captured TTB form. It is separ from the product brand and legal company. `None` means no unambiguous marked value was captured, not proof that the applicant has no trade name. Use the existing permit-number and approval-date filters to select a cohort. + +## Certificate trust security update + +This release requires `certifi>=2026.10.19` to remove trust paths affected by the +October 2026 eMudhra CA compromise. Upgrade this package and `certifi` in existing +environments. Explicit custom CA bundles remain the caller's responsibility. diff --git a/pyproject.toml b/pyproject.toml index 7e01653..0c970cc 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "hatchling.build" [project] name = "colacloud" -version = "0.5.0" +version = "0.5.1" description = "Python SDK for the COLA Cloud API - Access the TTB COLA Registry of alcohol product label approvals" readme = "README.md" license = "MIT" @@ -38,6 +38,7 @@ classifiers = [ "Typing :: Typed", ] dependencies = [ + "certifi>=2026.10.19", "httpx>=0.25.0", "pydantic>=2.0.0", ] diff --git a/src/colacloud/_version.py b/src/colacloud/_version.py index b848133..31cf983 100644 --- a/src/colacloud/_version.py +++ b/src/colacloud/_version.py @@ -1,3 +1,3 @@ """Version information for the COLA Cloud SDK.""" -__version__ = "0.5.0" +__version__ = "0.5.1"