[jtroup]

ENG-9345

what

Release 2026.10.22 with new minimum versions for three runtime
dependencies, and lock each at a fixed release:

• certifi 2026.10.19, for the eMudhra CA compromise.
• PyJWT 2.15.0, for known CVEs (locked at 2.15.1).
• urllib3 2.8.0, for known CVEs.

stacklet-admin does not import certifi or urllib3. They come in
through requests and botocore, so deptry ignores both for DEP002.
typos accepts the name certifi.

PyPI received certifi 2026.10.19 on 2026-10-20, inside the 7-day
exclude-newer window. A per-package exclude-newer-package entry
lets uv accept it now. The entry can go after 2026-10-27, when the
window covers the release.

Also move uv to 0.13.4 in .tool-versions. uv 0.13.4 rewrites
uv.lock in format revision 5, so contributors on older uv must
upgrade. Lock werkzeug and virtualenv, both dev-only, at newer
releases for known CVEs. Ignore editor backup files (*~).

why

Earlier certifi releases trust the compromised eMudhra CA, and
earlier PyJWT and urllib3 releases have known vulnerabilities. The
floors make every install of stacklet-admin pull in fixed releases,
not only the locked development environment. Epic ENG-9331 has the
eMudhra detail.

testing

I ran the CLI from this branch against a dev sandbox. SSO login,
show, and the account, policy, policy-collection,
repository and cubejs meta reads all work with the new certifi,
PyJWT and urllib3. A boto3 Cognito call completed over TLS, and
botocore loaded its CA bundle from the new certifi.

docs

NEWS.md has a security fixes note under a dated October 22, 2026
section.

---

🤖 Generated with Claude Code

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant Dev as Developer
    participant Tool as Tooling (uv, deptry, typos)
    participant Build as Build System (pyproject.toml)
    participant CLI as stacklet-admin CLI
    participant Requests as requests (urllib3)
    participant Boto3 as boto3/botocore
    participant CA as certifi CA Bundle
    participant Stacklet as Stacklet API

    Note over Dev,Stacklet: Dependency Security Hardening Flow

    Dev->>Tool: Install dependencies (uv 0.13.4)
    Tool->>Build: Read pyproject.toml constraints
    Build-->>Tool: Floors: certifi>=2026.10.19, PyJWT>=2.15.0, urllib3>=2.8.0

    Note over Tool,Build: Package resolution
    Tool->>Build: Resolve with uv exclude-newer window
    Build-->>Tool: Accept certifi 2026.10.19 (exclude-newer-package override)
    Tool->>Tool: Generate uv.lock (format revision 5)

    Note over CLI,Stacklet: Runtime Security Flow
    CLI->>CLI: Initialize (version 2026.10.22)
    CLI->>Requests: Make SSO login / API calls
    Requests->>Requests: Use urllib3>=2.8.0 (patched CVEs)
    Requests->>Stacklet: HTTPS request with TLS
    Stacklet-->>Requests: TLS handshake requires trusted CA

    CLI->>Boto3: Create Cognito session
    Boto3->>CA: Load CA bundle (certifi 2026.10.19)
    Note over CA: eMudhra CA now untrusted
    CA-->>Boto3: Trusted CAs only
    Boto3->>Stacklet: Cognito TLS call
    Stacklet-->>Boto3: Authenticated response

    alt Security check failure
        Requests->>Requests: Reject compromised eMudhra cert
        Stacklet-->>CLI: TLS error (connection failed)
        CLI-->>Dev: Show error
    else All checks pass
        Requests-->>CLI: API responses (account, policy, etc.)
        Boto3-->>CLI: Cognito auth success
        CLI-->>Dev: Verified all commands work
    end

    Note over Tool,Build: Dev-only dependency updates
    Tool->>Tool: Lock werkzeug, virtualenv (dev-only CVEs)
    Tool->>Tool: Ignore editor backups (*~)

Loading

_{Re-trigger cubic}