chore(deps): update dependency certifi to v2024.7.4 [security]
Metadata
Current evaluation
Renovate security bump of certifi from 2024.6.2 to 2024.7.4 merged via commit 38351514, addressing CVE-2024-39689 (GLOBALTRUST root removal). Later superseded by #1936 bumping to v2024.8.30.
Resolution: closed resolved
Reason: The PR was merged into main as commit 38351514 ("chore(deps): update dependency certifi to v2024.7.4 [security] (#1720)"), which appears in the requirements.txt commit history. It applied the pin change (2024.6.2 -> 2024.7.4) in 2 files to remediate CVE-2024-39689, and was approved by 2 reviewers with no failing CI checks.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [certifi](https://togithub.com/certifi/python-certifi) | `==2024.6.2` -> `==2024.7.4` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-39689](https://togithub.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc)
Certifi 2024.07.04 removes root certificates from "GLOBALTRUST" from the root store. These are in the process of being removed from Mozilla's trust store.
GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues". Conclusions of Mozilla's investigation can be found [here]( https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI).
---
### Release Notes
<details>
<summary>certifi/python-certifi (certifi)</summary>
### [`v2024.7.4`](https://togithub.com/certifi/python-certifi/compare/2024.06.02...2024.07.04)
[Compare Source](https://togithub.com/certifi/python-certifi/compare/2024.06.02...2024.07.04)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MjEuOSIsInVwZGF0ZWRJblZlciI6IjM3LjQyMS45IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Renovate security bump of certifi from 2024.6.2 to 2024.7.4 merged via commit 38351514, addressing CVE-2024-39689 (GLOBALTRUST root removal). Later superseded by #1936 bumping to v2024.8.30. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1720 in commit 38351514, upgrading certifi from 2024.6.2 to 2024.7.4 to remove GLOBALTRUST roots affected by CVE-2024-39689. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1720 and commit 38351514 updated certifi from 2024.6.2 to 2024.7.4, removing GLOBALTRUST roots for CVE-2024-39689. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #1720 into main, upgrading certifi from 2024.6.2 to 2024.7.4 to remove GLOBALTRUST roots and address CVE-2024-39689. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a security update upgrading certifi from v2024.6.2 to v2024.7.4 to address CVE-2024-39689. Approved by two reviewers, passed CI checks, and merged into main. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a Renovate pull request updating certifi from 2024.6.2 to 2024.7.4. The update resolves CVE-2024-39689 by removing compromised GLOBALTRUST root certificates from the trust store. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/charmcraft#1695
(confidence 90%)
Predecessor commit 7460a6fe bumped certifi to v2024.6.2, the exact base version this PR upgraded from.
-
Superseded By:
canonical/charmcraft#1936
(confidence 88%)
Commit 2f076407 later bumped certifi to v2024.8.30, superseding this pin with a newer release.
-
Related To:
canonical/charmcraft#1724
(confidence 55%)
Adjacent zipp security bump merged in the same dependency-update batch (commit 4632f60f).
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4897 chore(deps): update dependency certifi to v2024 [security] - autoclosed | snapcraft | closed | Autoclosed unmerged as redundant; certifi 2024.7.4 landed via #4896 (a4e2895da), with the matching docs update later merged in #4903. | |
| #1695 chore(deps): update dependency certifi to v2024.6.2 | charmcraft | merged | Renovate dependency bump PR: certifi 2024.2.2 → 2024.6.2 merged into main via commit 7460a6fe (+2/-2 lines in 2 requirements files), approved by 2 reviewers. | |
| #1181 chore(deps): update dependency certifi to v2023.7.22 [security] - autoclosed | charmcraft | closed | Autoclosed after the same certifi 2023.7.22 security update was merged via Dependabot PR #1182 in commit 8350a166. | |
| #946 Update dependency certifi to v2022.12.7 [SECURITY] | charmcraft | merged | Renovate security bump of certifi 2022.6.15 -> 2022.12.7 (removes TrustCor roots, CVE-2022-23491) merged via PR #946 (commit 8ab4b1bd, merge 9103c49c), pinning the version in requirements. | |
| #4896 build(deps): bump certifi from 2023.11.17 to 2024.7.4 | snapcraft | merged | Merged PR #4896, updating certifi from 2023.11.17 to 2024.7.4 in commit a4e2895da. | |
| #1182 build(deps): bump certifi from 2023.5.7 to 2023.7.22 | charmcraft | merged | Merged PR #1182 in commit 8350a166, upgrading certifi from 2023.5.7 to 2023.7.22. | |
| #4564 chore(deps): update dependency cryptography to v42 [security] | snapcraft | merged | Renovate bumped cryptography from 41.0.7 to 42.0.2 (fixing CVE-2023-50782 and CVE-2024-0727); PR #4564 was approved and squash-merged into main as commit ac421ab96. | |
| #4598 chore(deps): update dependency cryptography to v42.0.4 [security] | snapcraft | merged | Merged #4598 in commit 7cfb60986, upgrading cryptography from 42.0.2 to 42.0.4 to address CVE-2024-26130. | |
| #1936 build(deps): update dependency certifi to v2024.8.30 (main) | charmcraft | merged | Merged #1936 via commit 2f076407, updating certifi from 2024.7.4 to 2024.8.30 across two dependency files. | |
| #1529 chore(deps): update dependency cryptography to v42.0.2 [security] | charmcraft | merged | Renovate security bump of cryptography 42.0.1 -> 42.0.2 (CVE-2024-0727 PKCS12 DoS) merged to main as commit f80f2cd4, a 2-line requirements.txt pin change. |