From 4949a95f8eae7dd74f5126322cdf492b1aea3756 Mon Sep 17 00:00:00 2001 From: kaggle-agent Date: Tue, 20 Oct 2026 20:29:33 +0000 Subject: [PATCH] Require certifi>=2026.10.19 and pip>=26.2.2 (GHSA-6q48-6c7w-9gw2) --- kaggle_requirements.txt | 4 ++++ tests/test_certifi.py | 16 ++++++++++++++++ 2 files changed, 20 insertions(+) create mode 100644 tests/test_certifi.py diff --git a/kaggle_requirements.txt b/kaggle_requirements.txt index 56213f32..b325d320 100644 --- a/kaggle_requirements.txt +++ b/kaggle_requirements.txt @@ -15,6 +15,8 @@ bayesian-optimization boto3 catboost category-encoders +# GHSA-6q48-6c7w-9gw2: older bundles trust emSign intermediates with compromised keys. +certifi>=2026.10.19 cesium comm cytoolz @@ -108,6 +110,8 @@ pdf2image # The base image ships pillow 11.3; pin up to a newer release. # Remove once the base image ships >=12.2 itself. pillow>=12.2 +# pip < 26.2.2 always loads its vendored certifi, so it needs the GHSA-6q48-6c7w-9gw2 fix separately. +pip>=26.2.2 plotly-express pudb pyLDAvis diff --git a/tests/test_certifi.py b/tests/test_certifi.py new file mode 100644 index 00000000..31c41711 --- /dev/null +++ b/tests/test_certifi.py @@ -0,0 +1,16 @@ +import unittest + +import certifi +import pip +from packaging.version import Version + + +class TestCertifi(unittest.TestCase): + # GHSA-6q48-6c7w-9gw2: emSign ECC Root CA - G3 intermediates have compromised keys. + def test_emsign_ecc_g3_root_removed(self): + self.assertGreaterEqual(Version(certifi.__version__), Version("2026.10.19")) + with open(certifi.where()) as f: + self.assertNotIn("emSign ECC Root CA - G3", f.read()) + + def test_pip_vendored_certifi_patched(self): + self.assertGreaterEqual(Version(pip.__version__), Version("26.2.2"))