Repository navigation
chore(deps): Bump castore from 1.0.19 to 1.0.22 - #1249
Merged
Merged
Conversation
castore 1.0.22 refreshes the bundled CA store, including removing the eMudhra emSign Root CA - C1, emSign ECC Root CA - C3 and emSign ECC Root CA - G3 roots. Refs VULN-3216 Co-Authored-By: Geoff Goldsmith <geoff.goldsmith@sentry.io>
….0.22 Co-Authored-By: Geoff Goldsmith <geoff.goldsmith@sentry.io>
whatyouhide
approved these changes
Oct 22, 2026
whatyouhide
left a comment
whatyouhide
left a comment
Collaborator
There was a problem hiding this comment.
I'll merge but to be clear this doesn't affect anyone—these are local Mix lock files, and this SDK is something people use as a dep, and it already allows castore > 1, so we're good here and this is not a Sentry SDK vulnerability.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
castorefrom 1.0.19 to 1.0.22 in every lockfile that pins it, for VULN-3216 (eMudhra CA compromise).castore1.0.22 refreshes the bundled CA store. Among other changes, it removes the eMudhraemSign Root CA - C1,emSign ECC Root CA - C3andemSign ECC Root CA - G3roots.emSign Root CA - G1is still in the bundle.Changed lockfiles: only the
castoreline in each.mix-1.13-1.14.lockmix-1.15-1.17.lockmix-1.18.locktest_integrations/phoenix_app/mix.locktest_integrations/phoenix_app/mix-1.15-1.17.lockcastoreisn't listed inmix.exs. It's a transitive dependency, throughphoenixand others.mix.lockand the other integration-app lockfiles don't contain it, so they're unchanged.castore1.0.22 has no dependencies of its own and still requires Elixir~> 1.0.Verification: I took both checksums from the hex.pm release: the outer one is the tarball's SHA-256 and matches the hex.pm API, and the inner one comes from the tarball's
CHECKSUMfile. The same method reproduces the existing 1.0.19 entry exactly. I didn't runmixlocally, so CI is the real check.via Geoff Goldsmith.
--
View Junior Session [Sentry]