A security update: the images stop trusting eight leaked certificate authorities. No migration, nothing else changes. Docker deployments only need the new pins.
Security
- The images no longer trust the eight eMudhra (emSign) intermediates whose private keys leaked in October 2026. With those keys anyone could mint a certificate for any HTTPS endpoint the archiver or viewer calls, and the images accepted it: revocation is not checked outside browsers. certifi goes to 2026.10.19, which httpx reads, and both images upgrade the system
ca-certificatesto the trixie-security release that distrusts them, which aiohttp and the rest of Python's TLS read.
📋 Full changelog: docs/CHANGELOG.md