From beb72b9747cbd23c319e548d3bd4eeda326d1ba9 Mon Sep 17 00:00:00 2001 From: Dheeraj Kumar Ketireddy Date: Thu, 22 Oct 2026 16:07:44 +0530 Subject: [PATCH 1/5] fix(security): require certifi 2026.10.19 (eMudhra CA incident) certifi 2026.10.19 removes the emSign ECC Root CA - G3, whose keys were exposed in the eMudhra incident. Require it so installing plane-sdk always gets the fixed bundle that requests uses. Run the publish workflow on Python 3.10: pip 26.2.2, the fixed pip, needs Python 3.10, so the pip upgrade on 3.8 kept a pip whose vendored certifi still trusts G3. --- .github/workflows/publish.yml | 2 +- pyproject.toml | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 650663b..57f5fc4 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -14,7 +14,7 @@ jobs: - name: Set up Python uses: actions/setup-python@v4 with: - python-version: "3.8" + python-version: "3.10" - name: Install dependencies run: | diff --git a/pyproject.toml b/pyproject.toml index 931de2e..4943172 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -10,7 +10,13 @@ readme = "README.md" requires-python = ">=3.10" license = { text = "MIT" } authors = [{ name = "Plane", email = "engineering@plane.so" }] -dependencies = ["requests>=2.31.0", "pydantic>=2.4.0", "typing_extensions>=4.7"] +dependencies = [ + "requests>=2.31.0", + "pydantic>=2.4.0", + "typing_extensions>=4.7", + # 2026.10.19 removes the emSign ECC Root CA - G3 (eMudhra CA incident, 2026-10-20). + "certifi>=2026.10.19", +] [project.optional-dependencies] dev = ["pytest", "pytest-dependency"] From 7e4920d96b112d1700ffb211485f12f8fdfd07ef Mon Sep 17 00:00:00 2001 From: Dheeraj Kumar Ketireddy Date: Thu, 22 Oct 2026 16:19:45 +0530 Subject: [PATCH 2/5] chore: bump version to 0.3.2 --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 4943172..73c305d 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "plane-sdk" -version = "0.3.1" +version = "0.3.2" description = "Python SDK for Plane API" readme = "README.md" requires-python = ">=3.10" From ac17fff58862920e74a8ff99bd9babea434ded25 Mon Sep 17 00:00:00 2001 From: Dheeraj Kumar Ketireddy Date: Thu, 22 Oct 2026 16:29:27 +0530 Subject: [PATCH 3/5] ci: run the publish job on Python 3.12 Python 3.10 reached end of life on 2026-10-01. The package minimum stays at 3.10; the build output is a pure-Python wheel either way. --- .github/workflows/publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 57f5fc4..ca21f03 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -14,7 +14,7 @@ jobs: - name: Set up Python uses: actions/setup-python@v4 with: - python-version: "3.10" + python-version: "3.12" - name: Install dependencies run: | From ac0e478a84a2c999547ad0ef88c0b3109f6e5193 Mon Sep 17 00:00:00 2001 From: Dheeraj Kumar Ketireddy Date: Thu, 22 Oct 2026 16:44:49 +0530 Subject: [PATCH 4/5] ci: upgrade pip to 26.2.2 in the test workflow The runner ships pip 26.2.1, whose vendored certifi still trusts the emSign ECC Root CA - G3. --- .github/workflows/test.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a4ab751..24be1ef 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -21,7 +21,10 @@ jobs: python-version: ${{ matrix.python-version }} - name: Install dependencies + # pip 26.2.2 removes the emSign ECC Root CA - G3 from its vendored certifi + # (eMudhra CA incident); the runner's pip is older. run: | + python -m pip install --upgrade "pip>=26.2.2" pip install -e . pip install -r requirements.txt @@ -64,8 +67,11 @@ jobs: - name: Install dependencies # black is required by scripts/generate_v2_constants.py to format its output - # so the regenerated file matches the committed one byte-for-byte. - run: pip install -r requirements.txt + # so the regenerated file matches the committed one byte-for-byte. pip>=26.2.2: + # see the test job. + run: | + python -m pip install --upgrade "pip>=26.2.2" + pip install -r requirements.txt - name: Checkout plane-ee (api_v2 OpenAPI golden) # PLANE_EE_CHECKOUT_TOKEN: fine-grained PAT with read access to makeplane/plane-ee. From 2cb122ef8870289440a1d5a1fc9e5eb8472083f4 Mon Sep 17 00:00:00 2001 From: Dheeraj Kumar Ketireddy Date: Thu, 22 Oct 2026 16:53:22 +0530 Subject: [PATCH 5/5] chore: add the certifi floor to requirements.txt A venv set up from requirements.txt alone kept an older certifi, since requests accepts any certifi from 2023.5.7. --- requirements.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/requirements.txt b/requirements.txt index c761ec8..65a7ca5 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,6 +1,7 @@ # Runtime requests>=2.31.0 pydantic>=2.4.0 +certifi>=2026.10.19 # Dev / Lint / Test pytest>=7.4.0