From f9e04bbc36be211212ce87878af9e5719c89beb7 Mon Sep 17 00:00:00 2001 From: Federico Stagni Date: Mon, 26 Oct 2026 10:50:58 +0100 Subject: [PATCH] chore: Remove certificate package cooldown exemptions The temporary exemptions for certifi, ca-certificates and pip were only needed to let the eMudhra CA compromise security releases (CVE-2026-111943) through the 7-day release cooldown. They are no longer needed once those releases are older than the cooldown window, so the default protection is restored. The patched versions remain in pixi.lock: removing the exemptions does not re-resolve existing entries, it only applies to future updates. --- pixi.toml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/pixi.toml b/pixi.toml index c345a0c..63475a6 100644 --- a/pixi.toml +++ b/pixi.toml @@ -18,12 +18,6 @@ constructor = ">=3.16.0" # only released version on conda-forge is newer than the cutoff. [exclude-newer] constructor = "0d" -# Exempt the certificate trust stores and pip from the cooldown: security -# releases removing the compromised eMudhra/emSign CA keys (CVE-2026-111943) -# must not be blocked by the 7-day window. -ca-certificates = "0d" -certifi = "0d" -pip = "0d" # Feature for release scripts (separate environment, excludes build deps) [feature.release.dependencies]