[sammuti]

Why

Eight eMudhra P-384 intermediate CAs have private keys that anyone can recover in seconds (Mozilla bug 2083449). Several people have already recovered them, and some have posted publicly. On Oct 20, Mozilla and Chrome removed emSign ECC Root CA - G3, the root all six TLS intermediates chain to. Browsers are protected through their revocation lists, but code that relies on bundled roots (webpki-roots, certifi) keeps trusting certificates forged with these keys until those bundles are updated.

The CLI compiles its roots in through webpki-roots, so users stay exposed until they install a new release with this change.

Changes

• webpki-roots 1.0.2 → 1.0.10, which removes emSign ECC Root CA - G3
• certifi 2025.8.3 → 2026.10.19 in uv.lock and tests/mock-api-server/uv.lock. The uv.lock refresh also added three greenlet 3.2.4 wheel entries that were published after the last lock. The version is unchanged.

Notes

• certifi isn't a direct dependency of the SDK, so this lock bump only affects dev and CI. SDK users get the new bundle when their own resolver upgrades certifi. A follow-up could add a floor such as certifi>=2026.10.19 to force it.

Testing

• cargo check --workspace --all-targets passes.

Please cut a release after merge.

🤖 Generated with Claude Code

[github-actions]

⚠️ WARNING: This PR targets main instead of develop

This PR is targeting main which will trigger a production deployment when merged.

If this is a regular feature/fix PR, please change the base branch to develop.
If this is intentional (e.g., hotfix), you can ignore this warning.

Current base: main
Recommended base: develop

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 3

• Cargo.lock is excluded by !**/*.lock
• tests/mock-api-server/uv.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Configuration used: Repository: tower/tower-cli/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 6a900583-c2bb-4265-a2ac-8ee2c7ca147e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}