Update dependency certifi to v2022.12.7 [SECURITY]
Metadata
Current evaluation
Renovate security bump of certifi 2022.6.15 -> 2022.12.7 (removes TrustCor roots, CVE-2022-23491) merged via PR #946 (commit 8ab4b1bd, merge 9103c49c), pinning the version in requirements.
Resolution: closed resolved
Reason: PR #946 was approved and merged into main as merge commit 9103c49c, with commit 8ab4b1bd updating the certifi pin to 2022.12.7, resolving the CVE-2022-23491 advisory.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [certifi](https://togithub.com/certifi/python-certifi) | `==2022.6.15` -> `==2022.12.7` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2022-23491](https://togithub.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8)
Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store.
TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found [here](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ).
---
### Release Notes
<details>
<summary>certifi/python-certifi</summary>
### [`v2022.12.7`](https://togithub.com/certifi/python-certifi/compare/2022.09.24...2022.12.07)
[Compare Source](https://togithub.com/certifi/python-certifi/compare/2022.09.24...2022.12.07)
### [`v2022.9.24`](https://togithub.com/certifi/python-certifi/compare/2022.09.14...2022.09.24)
[Compare Source](https://togithub.com/certifi/python-certifi/compare/2022.09.14...2022.09.24)
### [`v2022.9.14`](https://togithub.com/certifi/python-certifi/compare/2022.06.15.2...2022.09.14)
[Compare Source](https://togithub.com/certifi/python-certifi/compare/2022.06.15.2...2022.09.14)
### [`v2022.6.15.2`](https://togithub.com/certifi/python-certifi/compare/2022.06.15.1...2022.06.15.2)
[Compare Source](https://togithub.com/certifi/python-certifi/compare/2022.06.15.1...2022.06.15.2)
### [`v2022.6.15.1`](https://togithub.com/certifi/python-certifi/compare/2022.06.15...2022.06.15.1)
[Compare Source](https://togithub.com/certifi/python-certifi/compare/2022.06.15...2022.06.15.1)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "after 1 am and before 7 am" in timezone Etc/UTC.
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://app.renovatebot.com/dashboard#github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC41MS4wIiwidXBkYXRlZEluVmVyIjoiMzQuNTQuMiJ9-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Renovate security bump of certifi 2022.6.15 -> 2022.12.7 (removes TrustCor roots, CVE-2022-23491) merged via PR #946 (commit 8ab4b1bd, merge 9103c49c), pinning the version in requirements. | |
| stealth/space-bunny-alpha | — | closed resolved | Renovate security bump of certifi from 2022.6.15 to 2022.12.7 (dropping TrustCor roots, CVE-2022-23491) was approved and merged via PR #946 (merge commit 9103c49c, commit 8ab4b1bd). | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in #946 via commit 9103c49c, upgrading certifi from 2022.6.15 to 2022.12.7 to address CVE-2022-23491 by removing TrustCor root certificates. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged automated update of the certifi dependency to v2022.12.7 to resolve CVE-2022-23491, removing compromised TrustCor root certificates. The change was approved by a reviewer and passed all CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading certifi from v2022.6.15 to v2022.12.7. The change addresses CVE-2022-23491 by removing compromised TrustCor root certificates from the trust store. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/charmcraft#1182
(confidence 60%)
Later certifi bump 2023.5.7 -> 2023.7.22 (commit 8350a166) continues the same dependency line.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1720 chore(deps): update dependency certifi to v2024.7.4 [security] | charmcraft | merged | Renovate security bump of certifi from 2024.6.2 to 2024.7.4 merged via commit 38351514, addressing CVE-2024-39689 (GLOBALTRUST root removal). Later superseded by #1936 bumping to v2024.8.30. | |
| #1182 build(deps): bump certifi from 2023.5.7 to 2023.7.22 | charmcraft | merged | Merged PR #1182 in commit 8350a166, upgrading certifi from 2023.5.7 to 2023.7.22. | |
| #4000 build(deps): bump certifi from 2022.9.24 to 2022.12.7 | snapcraft | closed | Closed unmerged as obsolete after certifi 2023.5.7 was adopted in #4129 (fc9f9ae44), superseding the proposed 2022.12.7 update. | |
| #15 Update dependency certifi to v2023 [SECURITY] - autoclosed | imagecraft | closed | Renovate PR #15 proposed certifi 2023.7.22 for security fixes but was autoclosed unmerged after inactivity; no resolving merge or commit was recorded. | |
| #945 Bump certifi from 2022.6.15 to 2022.12.7 | charmcraft | closed | Dependabot's certifi 2022.6.15→2022.12.7 bump was closed unmerged as redundant: Renovate PR canonical/charmcraft#946 had already landed the same upgrade (commit 8ab4b1bd, merge 9103c49c). | |
| #1695 chore(deps): update dependency certifi to v2024.6.2 | charmcraft | merged | Renovate dependency bump PR: certifi 2024.2.2 → 2024.6.2 merged into main via commit 7460a6fe (+2/-2 lines in 2 requirements files), approved by 2 reviewers. | |
| #4896 build(deps): bump certifi from 2023.11.17 to 2024.7.4 | snapcraft | merged | Merged PR #4896, updating certifi from 2023.11.17 to 2024.7.4 in commit a4e2895da. | |
| #4291 build(deps): bump certifi from 2022.12.7 to 2023.7.22 in /docs/.sphinx | snapcraft | merged | Dependabot PR merged as commit 363d2bd47, bumping certifi 2022.12.7 -> 2023.7.22 in docs/.sphinx requirements. Companion PR #4292 did the same for the main requirements file. | |
| #6512 build(deps): bump certifi to 2026.10.19 | snapcraft | merged | Bump certifi dependency to 2026.10.19 to resolve an OSV vulnerability. Merged into main. |