v2.52.0 (the trust store fix, and credentials that stay out of settings.json)
One critical dependency fix and three features. Upgrade for the first.
- Security: the bundled trust store drops compromised roots. CertMate's outbound TLS, including ACME-over-HTTPS to the certificate authority, trusted a
certifithat shipped emSign root CAs whose intermediate signing keys were compromised (GHSA-6q48-6c7w-9gw2, critical).certifimoves to 2026.10.19, the release that removes them. Every deployment should upgrade. - Storage backend credentials can be secret references. The credential a storage backend needs (the HashiCorp Vault or OpenBao token, the Azure or Infisical client secret, the AWS keys) can be given as
<field>_file(a mounted file path) or<field>_env(an environment variable) instead of a literal insettings.json, read fresh each time, the way the DNS provider tokens and the OIDC client secret already work. See docs/storage.md. - The MCP server is on npm.
npx certmate-mcp-serverruns it with no local build or checkout (#1017). - Client certificates default to the deployment's organisation and unit. A new client certificate takes its O and OU from the deployment's configured values, mirroring the country and state defaults added earlier.
Under the hood: coverage now measures through sys.monitoring with the test toolchain pinned, and the CI action set and the Python 3.14 leg were updated.
The API contract is unchanged (2.56).