Security update
Refresh the independent TLS trust stores affected by the eMudhra CA compromise. Updating the application alone does not update pip, uv, operating-system certificates or custom CA bundles. Bootstrap package-manager upgrades through an already corrected trust store; certificate validation must stay enabled.
Fixed
- Refresh independent TLS trust stores after the eMudhra CA compromise.
CI and Docker bootstrap now require pip 26.2.2 and uv 0.13.4 or newer. The lite
package and hand-curated Docker dependencies require certifi 2026.10.19, matching
the main package. Docker builds reject the affected root certificates before
bootstrapping pip and after installing application dependencies; CI builds both
standard and slim images. Existing installations must also update their package
managers, operating system certificates, and any custom trust bundles.