Skip to content

Require pip 26.2.2+ and refresh CA cert packages - #51

Open
rclune wants to merge 1 commit into
mainfrom
fix/upgrade_pip_version
Open

rclune wants to merge 1 commit into
mainfrom
fix/upgrade_pip_version

Conversation

@rclune

@rclune rclune commented Oct 22, 2026

Copy link
Copy Markdown
Member

Older pip releases still trust the withdrawn emSign root CA certificate, so require a newer pip and updated certificate packages.

  • Upgrade pip to >=26.2.2 in the documentation workflow before installing Sphinx.
  • Document the pip requirement and add an explicit pip upgrade step in installation.md.
  • Unpin ca-certificates and set certifi>=2026.10.19 and pip>=26.2.2 in se3_flow_matching/fm.yml.

This change is in response to the security issues outlined in: https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576/47

Older pip releases still trust the withdrawn emSign root CA certificate, so require a newer pip and updated certificate packages.

- Upgrade pip to >=26.2.2 in the documentation workflow before installing Sphinx.
- Document the pip requirement and add an explicit pip upgrade step in installation.md.
- Unpin ca-certificates and set certifi>=2026.10.19 and pip>=26.2.2 in se3_flow_matching/fm.yml.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant