Security: eMudhra intermediate CA compromise
- `certifi>=2026.10.19` is now required. It drops trust in the compromised eMudhra/emSign CAs.
- Generated Dockerfiles and local `bentoml build` install `uv==0.13.4` with `--require-hashes` whenever uv is missing or older (uv < 0.13.4 bundles the compromised CAs). pip 26.2.2 is used where supported. (#5757)
Action for users: run `bentoml build` again with 1.4.40, then redeploy, so your bento image picks up the fixed certifi and uv.
Also in this release
- Agent skills for creating BentoML projects and for deploying to Kubernetes and EC2 (#5705, #5683)
- Windows tar symlink extraction and fastai CI dependency resolution fix (#5689)
- Docs and CI updates (#5710, #5715, #5741, #5702, #5758, #5759, #5760)
Full Changelog: v1.4.39...v1.4.40