Repository navigation
fix(security): build with Go 1.26.10 and require certifi 2026.10.19 - #837
Merged
Merged
Conversation
Eight eMudhra intermediate CA keys were compromised (https://emudhra.we-have-a-problem.com/). - toolchain go1.26.10 in every go.mod (go minimum unchanged) and Go 1.26.10 in the Go e2e image. - Python SDKs require certifi>=2026.10.19; all poetry.lock files bumped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Generated-by: termag
Contributor
☂️ Python Coverage
Overall Coverage
New FilesNo new covered files... Modified FilesNo covered modified files...
|
mayberryzane
approved these changes
Oct 20, 2026
Merged
Vadman97
pushed a commit
that referenced
this pull request
Oct 20, 2026
🤖 I have created a release *beep* *boop* --- <details><summary>launchdarkly-observability-python: 1.3.4</summary> ## [1.3.4](launchdarkly-observability-python-1.3.3...launchdarkly-observability-python-1.3.4) (2026-10-20) ### Bug Fixes * **security:** build with Go 1.26.10 and require certifi 2026.10.19 ([#837](#837)) ([acfdb8b](acfdb8b)) </details> <details><summary>go: 1.3.1</summary> ## [1.3.1](go/v1.3.0...go/v1.3.1) (2026-10-20) ### Bug Fixes * **security:** build with Go 1.26.10 and require certifi 2026.10.19 ([#837](#837)) ([acfdb8b](acfdb8b)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Overview** > **Release Please** cuts patch releases for the **Go** (`1.3.0` → `1.3.1`) and **Python** (`1.3.3` → `1.3.4`) observability SDKs, with matching updates to `.release-please-manifest.json`, package metadata (`InstrumentationVersion`, `pyproject.toml`), changelogs, and Python **PROVENANCE** verification examples. > > Both releases document the same **security** fix ([#837](#837)): building with **Go 1.26.10** and requiring **`certifi` ≥ 2026.10.19** on the Python package. This PR does not change runtime logic—only release bookkeeping for those already-merged changes. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 9154dde. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Eight eMudhra intermediate CA private keys were compromised and revoked on Oct 18–19 (advisory). Whoever holds them can issue a certificate for any hostname.
toolchain go1.26.10to everygo.mod; thego 1.25.0minimum is unchanged. Our builds and CI use the fixed crypto/x509, and customers aren't forced onto a newer Go. The Go e2e image moves from 1.23.1 to 1.26.10.observability-python,highlight-py) now requirecertifi>=2026.10.19, so fresh installs get the fixed CA bundle. All fivepoetry.lockfiles are bumped, and certifi is the only package that changes in each.Verified
Tested against the advisory's test site
dv-g3b-emudhra.we-have-a-problem.com:x509: no valid chains built; 1.26.1 accepts it.SSLError; 2026.6.17 connects.e2e/go'smain redeclarederror is pre-existing: it's a directory of separate single-file programs.Not fixed here (customer runtimes)
The SDKs use whatever trust store the host process provides, so this only partly protects customers. The rest is worth a customer notice:
NODE_OPTIONS=--use-openssl-catogether with a patched OS store does block the chain.NODE_USE_SYSTEM_CA=1doesn't: it only adds to Node's bundled roots.turbo.ymlandsession-replay-legacy-arch.yml) is left out because this token can't push workflow files. It needs a follow-up from someone withworkflowscope.🤖 Generated with Claude Code
Opened from termag
Note
Overview
Responds to the compromised eMudhra intermediate CA keys by pinning Go 1.26.10 for builds and requiring a patched certifi CA bundle for Python SDK installs.
Go: Every affected
go.modaddstoolchain go1.26.10while leavinggo 1.25.0as the minimum, so CI and local builds use fixedcrypto/x509without raising the declared Go floor. Thee2e/goDocker image defaultGO_VERSIONmoves from 1.23.1 to 1.26.10.Python:
sdk/@launchdarkly/observability-pythonandsdk/highlight-pynow depend oncertifi>=2026.10.19(with a comment that this bundle drops the bad intermediates). Fivepoetry.lockfiles are refreshed so resolved certifi is 2026.10.19; locks otherwise only change for that package.Reviewed by Cursor Bugbot for commit 9d30b88. Bugbot is set up for automated code reviews on this repo. Configure here.