# The eMudhra CA compromise: What Python developers need to update


Python developers need to update their packaging tools after the eMudhra certificate authority compromise. Upstream [pip](https://pydevtools.com/handbook/reference/pip.md) and [uv](https://pydevtools.com/handbook/reference/uv.md) carry their own certificate stores.

Certificate authorities help HTTPS clients verify that they are connecting to the intended server. Researchers discovered that the private keys for eight eMudhra intermediate CA certificates were recoverable from public information. An attacker who intercepts a connection could use those keys to impersonate a service such as a package repository. [Read the incident report](https://emudhra.we-have-a-problem.com/).

## Check which certificate stores your tools use

Browsers received protections through their certificate revocation systems. Many other HTTPS clients require software updates to stop trusting the compromised certificates.

Upstream pip includes its own copy of certifi, the package containing trusted CA certificates. Updating your application's certifi dependency does not replace pip's bundled copy. pip uses system certificates alongside its bundle, so an operating system update alone is insufficient. For distribution-managed pip, follow the distribution's security updates. [Read pip's certificate documentation](https://pip.pypa.io/en/stable/topics/https-certificates/).

uv uses a separate bundled certificate store by default, which also required an update. [Read uv's security advisory](https://github.com/astral-sh/uv/security/advisories/GHSA-hq85-5cpj-mr62).

## Update each environment and build image

Use these versions or newer, following the [Python security guidance](https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576) and [uv's follow-up security release](https://github.com/astral-sh/uv/releases/tag/0.13.5):

| Component | Version |
|---|---|
| pip | 26.2.2 |
| certifi | 2026.10.19 |
| uv | 0.13.5 |

For pip, start with the official guidance's **hash-verified installation command**: it checks the downloaded file against an expected checksum and rejects a mismatched file.

Update pip in each existing {{< term "virtual-environment" >}} that contains it. Update certifi wherever applications depend on it, including dependency pins and {{< term "lockfile" "lockfiles" >}} that would otherwise restore an older copy.

Before using uv to download its own update, select a patched system certificate store as [the Python guidance explains](https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576/10). Then follow the [installation-specific upgrade instructions](https://pydevtools.com/handbook/how-to/how-to-upgrade-uv.md).

Update uv-managed Python builds separately. Existing environments still need their pip updated, as [uv's release notes explain](https://github.com/astral-sh/uv/releases/tag/0.13.5).

For containers and CI, update pinned tools and dependencies, fetch patched base images, and rebuild with layer caching disabled. Redeploy the rebuilt images so running workloads receive the fixes. The [Python advisory](https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576) also covers affected tools including [conda](https://pydevtools.com/handbook/reference/conda.md), [pixi](https://pydevtools.com/handbook/reference/pixi.md), and sigstore.