Update Python tooling after the eMudhra certificate incident

Older pip installations can still trust the affected eMudhra certificates after an operating-system update. The Python security team explains that pip also loads its bundled certifi store. ^[1]

Update pip in each environment

Activate each existing virtual environment. The advisory supplies this wheel URL and checksum to bootstrap a fixed pip installation. ^[1]

bash

python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"

Check the current advisory before rebuilding

The advisory now recommends at least certifi 2026.10.19, pip 26.2.2 and uv 0.13.6. It also lists updated Python releases, including 3.15.2, 3.14.10 and 3.13.18. These recommendations supersede the older versions in the video. ^[1]

Rebuild container images with layer caching disabled so the system certificate packages are refreshed. Review the advisory's separate instructions for macOS framework installations and other packaging tools you use. ^[1]

Updating one environment leaves the others untouched. Keep the advisory beside your environment list until every installation and rebuilt image has been covered.