Release candidate for a 0.9.10 patch release on the 0.9 line (pydantic v1), built from release/0.9.x. Docker :latest stays on 0.9.9 until 0.9.10 ships.
What's Changed
- build: keep test certificate fixtures out of the images (backport #979 to 0.9.x) by @EliMoshkovich in #980
Highlights since 0.9.10-rc.2:
- The trust-store test's certificate fixture is no longer in the images.
opal_common/tests/emudhra_compromised_cas.pemholds the compromised eMudhra certificates (CVE-2026-111943) for the test that checks the build rejects them. rc.2's notes said it was kept out, but the.dockerignorerule didn't apply to the release build, which uses a Git context, so every rc.2 image still carried the file. Nothing loads it as a trust anchor, so rc.2 is not vulnerable, but a search of an image's files for those certificates reports it. The Dockerfile now excludes it withCOPY --exclude, and CI fails if any.pemreaches the images. - The images are now built with dockerfile frontend 1.19 (
# syntax=docker/dockerfile:1.19, pinned by digest), whichCOPY --excludeneeds. Building them requires BuildKit.
Everything in 0.9.10-rc.2 is unchanged: the eMudhra CA distrust, the build-time trust-store check, and the PyJWT and GitPython floors.
The same change is on master (0.10 line) in #979.
Full Changelog: 0.9.10-rc.2...0.9.10-rc.3