damccorm · Oct 30, 2026 · Oct 29, 2026 · Oct 29, 2026
diff --git a/runners/flink/job-server-container/Dockerfile b/runners/flink/job-server-container/Dockerfile
@@ -19,7 +19,13 @@
 FROM eclipse-temurin:11
 MAINTAINER "Apache Beam <dev@beam.apache.org>"
 
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y libltdl7
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y libltdl7 \
+    && (keytool -list -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit \
+      | grep -iE "emsign|emudhra" \
+      | awk -F', ' '{print $1}' \
+      | while IFS= read -r alias; do \
+          keytool -delete -noprompt -alias "${alias}" -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit; \
+        done)
 
 ADD beam-runners-flink-job-server.jar /opt/apache/beam/jars/
 ADD flink-job-server.sh /opt/apache/beam/

diff --git a/runners/spark/job-server/container/Dockerfile b/runners/spark/job-server/container/Dockerfile
@@ -19,7 +19,13 @@
 FROM eclipse-temurin:11
 MAINTAINER "Apache Beam <dev@beam.apache.org>"
 
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y libltdl7
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y libltdl7 \
+    && (keytool -list -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit \
+      | grep -iE "emsign|emudhra" \
+      | awk -F', ' '{print $1}' \
+      | while IFS= read -r alias; do \
+          keytool -delete -noprompt -alias "${alias}" -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit; \
+        done)
 
 ADD beam-runners-spark-job-server.jar /opt/apache/beam/jars/
 ADD spark-job-server.sh /opt/apache/beam/

diff --git a/sdks/go/container/Dockerfile b/sdks/go/container/Dockerfile
@@ -16,7 +16,7 @@
 # limitations under the License.
 ###############################################################################
 
-FROM gcr.io/distroless/base-nossl-debian12:latest AS base_image
+FROM gcr.io/distroless/base-nossl-debian13:latest AS base_image
 
 # Distroless base image has many layers. Squash into single layer
 FROM scratch

diff --git a/sdks/java/container/Dockerfile b/sdks/java/container/Dockerfile
@@ -57,4 +57,14 @@ RUN if [ "${pull_licenses}" = "false" ] ; then \
 # Add Google Cloud Profiler agent.
 COPY target/profiler/* /opt/google_cloud_profiler/
 
+# Remove distrusted eMudhra / emSign root CA certificates from the JDK truststore.
+RUN CACERTS="${JAVA_HOME}/lib/security/cacerts"; \
+    if [ ! -f "${CACERTS}" ]; then CACERTS="${JAVA_HOME}/jre/lib/security/cacerts"; fi; \
+    keytool -list -keystore "${CACERTS}" -storepass changeit \
+      | grep -iE "emsign|emudhra" \
+      | awk -F', ' '{print $1}' \
+      | while IFS= read -r alias; do \
+          keytool -delete -noprompt -alias "${alias}" -keystore "${CACERTS}" -storepass changeit; \
+        done
+
 ENTRYPOINT ["/opt/apache/beam/boot"]
diff --git a/sdks/java/container/distroless/Dockerfile b/sdks/java/container/distroless/Dockerfile
@@ -34,6 +34,7 @@ RUN if [ -z "${TARGETARCH}" ]; then echo "fatal: TARGETARCH not set; run as dock
 FROM ${DISTROLESS_BASE}:latest-${TARGETARCH} AS distroless
 
 COPY --from=base /opt /opt
+COPY --from=base /opt/java/openjdk/lib/security/cacerts /etc/ssl/certs/java/cacerts
 
 # Along with the LANG environment variable above, prevents internally discovered failing bugs related to Dataflow Flex
 # template character encodings.

diff --git a/sdks/java/container/distroless/common.gradle b/sdks/java/container/distroless/common.gradle
@@ -60,7 +60,7 @@ docker {
     files "./build/"
     buildArgs([
             'BEAM_BASE': base,
-            'DISTROLESS_BASE': "gcr.io/distroless/java${imageJavaVersion}-debian12"
+            'DISTROLESS_BASE': "gcr.io/distroless/java${imageJavaVersion}-debian13"
     ])
     buildx project.useBuildx()
     platform(*project.containerPlatforms())

diff --git a/sdks/java/expansion-service/container/Dockerfile b/sdks/java/expansion-service/container/Dockerfile
@@ -47,4 +47,12 @@ RUN if [ "${pull_licenses}" = "false" ] ; then \
     rm -rf /opt/apache/beam/third_party_licenses ; \
    fi
 
+# Remove distrusted eMudhra / emSign root CA certificates from the JDK truststore.
+RUN keytool -list -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit \
+      | grep -iE "emsign|emudhra" \
+      | awk -F', ' '{print $1}' \
+      | while IFS= read -r alias; do \
+          keytool -delete -noprompt -alias "${alias}" -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit; \
+        done
+
 ENTRYPOINT ["/opt/apache/beam/boot", "-config_file", "./expansion_service_config.yml", "-dependencies_dir", "jars/"]
diff --git a/sdks/java/transform-service/controller-container/Dockerfile b/sdks/java/transform-service/controller-container/Dockerfile
@@ -43,4 +43,12 @@ RUN if [ "${pull_licenses}" = "false" ] ; then \
     rm -rf /opt/apache/beam/third_party_licenses ; \
    fi
 
+# Remove distrusted eMudhra / emSign root CA certificates from the JDK truststore.
+RUN keytool -list -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit \
+      | grep -iE "emsign|emudhra" \
+      | awk -F', ' '{print $1}' \
+      | while IFS= read -r alias; do \
+          keytool -delete -noprompt -alias "${alias}" -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit; \
+        done
+
 ENTRYPOINT ["./boot", "-config_file", "./transform_service_config.yml"]
diff --git a/sdks/python/container/distroless/Dockerfile b/sdks/python/container/distroless/Dockerfile
@@ -24,7 +24,7 @@ LABEL Author="Apache Beam <dev@beam.apache.org>"
 
 RUN if [ -z "${TARGETARCH}" ]; then echo "fatal: TARGETARCH not set; run as docker buildx build or use --build-arg=TARGETARCH=amd64|arm64" >&2; exit 1; fi
 
-FROM gcr.io/distroless/python3-debian12:latest-${TARGETARCH} AS distroless
+FROM gcr.io/distroless/python3-debian13:latest-${TARGETARCH} AS distroless
 
 # Prevents internal errors found with distroless container images and Flex templates.
 COPY --from=base /usr/lib/locale /usr/lib/locale

diff --git a/sdks/python/container/ml/py310/base_image_requirements.txt b/sdks/python/container/ml/py310/base_image_requirements.txt
@@ -37,7 +37,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -96,16 +96,16 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 h5py==3.14.0
 hf-xet==1.6.0
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 huggingface_hub==0.36.2
 hyperframe==6.1.0

diff --git a/sdks/python/container/ml/py310/gpu_image_requirements.txt b/sdks/python/container/ml/py310/gpu_image_requirements.txt
@@ -41,7 +41,7 @@ bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
 cbor2==6.1.4
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -116,16 +116,16 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 h5py==3.14.0
 hf-xet==1.6.0
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httptools==0.8.0
 httpx==0.28.1
 huggingface_hub==0.36.2

diff --git a/sdks/python/container/ml/py311/base_image_requirements.txt b/sdks/python/container/ml/py311/base_image_requirements.txt
@@ -36,7 +36,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -94,16 +94,16 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 h5py==3.14.0
 hf-xet==1.6.0
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 huggingface_hub==0.36.2
 hyperframe==6.1.0

diff --git a/sdks/python/container/ml/py311/gpu_image_requirements.txt b/sdks/python/container/ml/py311/gpu_image_requirements.txt
@@ -40,7 +40,7 @@ bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
 cbor2==6.1.4
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -114,16 +114,16 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 h5py==3.14.0
 hf-xet==1.6.0
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httptools==0.8.0
 httpx==0.28.1
 huggingface_hub==0.36.2

diff --git a/sdks/python/container/ml/py312/base_image_requirements.txt b/sdks/python/container/ml/py312/base_image_requirements.txt
@@ -35,7 +35,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -93,16 +93,16 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 h5py==3.14.0
 hf-xet==1.6.0
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 huggingface_hub==0.36.2
 hyperframe==6.1.0

diff --git a/sdks/python/container/ml/py312/gpu_image_requirements.txt b/sdks/python/container/ml/py312/gpu_image_requirements.txt
@@ -39,7 +39,7 @@ bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
 cbor2==6.1.4
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -113,16 +113,16 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 h5py==3.14.0
 hf-xet==1.6.0
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httptools==0.8.0
 httpx==0.28.1
 huggingface_hub==0.36.2

diff --git a/sdks/python/container/ml/py313/base_image_requirements.txt b/sdks/python/container/ml/py313/base_image_requirements.txt
@@ -35,7 +35,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -92,16 +92,16 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 h5py==3.14.0
 hf-xet==1.6.0
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 huggingface_hub==0.36.2
 hyperframe==6.1.0

diff --git a/sdks/python/container/py310/base_image_requirements.txt b/sdks/python/container/py310/base_image_requirements.txt
@@ -35,7 +35,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -89,14 +89,14 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 hyperframe==6.1.0
 hypothesis==6.148.3

diff --git a/sdks/python/container/py311/base_image_requirements.txt b/sdks/python/container/py311/base_image_requirements.txt
@@ -34,7 +34,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -87,14 +87,14 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 hyperframe==6.1.0
 hypothesis==6.148.3

diff --git a/sdks/python/container/py312/base_image_requirements.txt b/sdks/python/container/py312/base_image_requirements.txt
@@ -33,7 +33,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -86,14 +86,14 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 hyperframe==6.1.0
 hypothesis==6.148.3