dervoeti · Oct 27, 2026 · Oct 21, 2026 · Oct 26, 2026 · Oct 26, 2026 · Oct 26, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -102,6 +102,11 @@ All notable changes to this project will be documented in this file.
 - airflow: Bump `apache-airflow-providers-cncf-kubernetes` to `10.18.0` for `3.2.2`. This version includes a fix for scheduler crashloops when using
   KubernetesExecutor ([#1709]).
 - hive: Bump hive-metastore-opa-authorizer to 1.0.1 to fix a [serialization bug](https://github.com/boschglobal/hive-metastore-opa-authorizer/pull/3) ([#1712]).
+- airflow: Bump certifi to `2026.10.23` and uv to `0.13.4`, and point grpcio to the system trust store ([#1715]).
+- airflow: Bump the bundled pip to `26.2.2` for Airflow 3.x. For Airflow 2.9.3, which uses Python 3.9 and cannot use this pip version, point pip to the system trust store instead ([#1715]).
+- superset: Bump certifi to `2026.10.23` and uv to `0.13.4` ([#1715]).
+- opensearch-dashboards: Use the system trust store for Node.js instead of its bundled root certificates ([#1715]).
+- spark-connect-client: Point grpcio to the system trust store ([#1715]).
 
 ### Removed
 
@@ -173,6 +178,7 @@ All notable changes to this project will be documented in this file.
 [#1712]: https://github.com/stackabletech/docker-images/pull/1712
 [#1713]: https://github.com/stackabletech/docker-images/pull/1713
 [#1714]: https://github.com/stackabletech/docker-images/pull/1714
+[#1715]: https://github.com/stackabletech/docker-images/pull/1715
 [#1717]: https://github.com/stackabletech/docker-images/pull/1717
 [#1718]: https://github.com/stackabletech/docker-images/pull/1718
 [#1720]: https://github.com/stackabletech/docker-images/pull/1720

diff --git a/airflow/Dockerfile b/airflow/Dockerfile
@@ -155,7 +155,19 @@ ENV UV_LINK_MODE=copy
 ENV UV_PYTHON_INSTALL_DIR=/stackable/python
 
 # This installs the Python runtime
-RUN uv venv --python "${PYTHON_VERSION}" --system-site-packages /stackable/app
+RUN <<EOF
+uv venv --python "${PYTHON_VERSION}" --system-site-packages /stackable/app
+
+# The pip bundled with the uv-managed Python trusts the certificates of its vendored certifi,
+# which contains the compromised "emSign ECC Root CA - G3" root certificate (GHSA-6q48-6c7w-9gw2).
+# pip 26.2.2 ships a fixed certifi, but requires Python >= 3.10. For Python 3.9, pip falls back
+# to PIP_CERT (set in the final image) instead.
+if [ "${PYTHON_VERSION}" != "3.9" ]; then
+  # Upgrade pip in the uv-managed base interpreter (not the venv), which is where pip lives.
+  # uv marks this interpreter as externally managed, so --break-system-packages is required.
+  uv pip install --python "$(uv python find --system --managed-python "${PYTHON_VERSION}")" --break-system-packages pip==26.2.2
+fi
+EOF
 
 # Instead of activating the environment each time
 ENV VIRTUAL_ENV=/stackable/app
@@ -325,6 +337,16 @@ ENV VIRTUAL_ENV=$HOME/app
 ENV AIRFLOW_USER_HOME_DIR=$HOME
 ENV PATH=$HOME/app/bin:$PATH:/bin
 ENV AIRFLOW_HOME=$HOME/airflow
+# On Python 3.9 (Airflow 2.x), pip uses its own vendored copy of certifi instead of the system trust store.
+# Point it to the system trust store, so it does not trust the compromised
+# "emSign ECC Root CA - G3" root certificate (GHSA-6q48-6c7w-9gw2), which the system trust store no longer contains.
+# On newer Python versions pip ignores this in favour of truststore, see the pip upgrade in the build stage.
+# PIP_CERT sets pip's --cert option, see https://pip.pypa.io/en/stable/cli/pip/#cmdoption-cert
+# and https://pip.pypa.io/en/stable/topics/configuration/#environment-variables
+ENV PIP_CERT=/etc/pki/tls/certs/ca-bundle.crt
+# Same for grpcio, which bundles its own roots.pem,
+# see https://github.com/grpc/grpc/blob/master/doc/environment_variables.md
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/pki/tls/certs/ca-bundle.crt
 
 COPY --from=airflow-build-image --chown=${STACKABLE_USER_UID}:0 /stackable/ ${HOME}/
 

diff --git a/airflow/boil-config.toml b/airflow/boil-config.toml
@@ -33,7 +33,7 @@ tini-version = "0.19.0"
 # Bump to the latest release found here: https://github.com/astral-sh/uv/releases
 # Mirror uv (no `v` prefix) via https://github.com/stackabletech/docker-images/actions/workflows/mirror.yaml
 # Note: Mirrored to the `stackable` project, but should probably move elsewhere.
-uv-version = "0.11.19"
+uv-version = "0.13.4"
 airflow-extras-other = "async,amazon,celery,cncf.kubernetes,docker,dask,elasticsearch,ftp,grpc,hashicorp,http,ldap,google,google_auth,microsoft.azure,odbc,pandas,postgres,redis,sendgrid,sftp,slack,ssh,statsd,virtualenv,trino"
 opa-auth-manager = "airflow-2"
 # Node module stream used to install pnpm/yarn and build the frontend assets.
@@ -73,7 +73,7 @@ tini-version = "0.19.0"
 # Bump to the latest release found here: https://github.com/astral-sh/uv/releases
 # Mirror uv (no `v` prefix) via https://github.com/stackabletech/docker-images/actions/workflows/mirror.yaml
 # Note: Mirrored to the `stackable` project, but should probably move elsewhere.
-uv-version = "0.11.19"
+uv-version = "0.13.4"
 
 # Airflow extras are defined in separate lists to make them easier to check against the links below.
 # The lists will be concatenated and duplicates removed in the dockerfile.
@@ -134,7 +134,7 @@ tini-version = "0.19.0"
 # Bump to the latest release found here: https://github.com/astral-sh/uv/releases
 # Mirror uv (no `v` prefix) via https://github.com/stackabletech/docker-images/actions/workflows/mirror.yaml
 # Note: Mirrored to the `stackable` project, but should probably move elsewhere.
-uv-version = "0.11.19"
+uv-version = "0.13.4"
 
 # Airflow extras are defined in separate lists to make them easier to check against the links below.
 # The lists will be concatenated and duplicates removed in the dockerfile.
@@ -195,7 +195,7 @@ tini-version = "0.19.0"
 # Bump to the latest release found here: https://github.com/astral-sh/uv/releases
 # Mirror uv (no `v` prefix) via https://github.com/stackabletech/docker-images/actions/workflows/mirror.yaml
 # Note: Mirrored to the `stackable` project, but should probably move elsewhere.
-uv-version = "0.11.19"
+uv-version = "0.13.4"
 
 # Airflow extras are defined in separate lists to make them easier to check against the links below.
 # The lists will be concatenated and duplicates removed in the dockerfile.

diff --git a/airflow/stackable/constraints/2.9.3/constraints-python3.9.txt b/airflow/stackable/constraints/2.9.3/constraints-python3.9.txt
@@ -241,7 +241,7 @@ cachetools==5.3.3
 cassandra-driver==3.29.1
 cattrs==23.2.3
 celery==5.4.0
-certifi==2024.7.4
+certifi==2026.10.23
 cffi==1.16.0
 cfgv==3.4.0
 cfn-lint==1.6.0

diff --git a/airflow/stackable/constraints/3.0.6/constraints-python3.12.txt b/airflow/stackable/constraints/3.0.6/constraints-python3.12.txt
@@ -264,7 +264,7 @@ cattrs==25.1.1
 # Bumped to newest version (from 5.5.2) to reduce celery on redis issues
 # See https://github.com/stackabletech/airflow-operator/issues/676
 celery==5.5.3
-certifi==2025.8.3
+certifi==2026.10.23
 cffi==1.17.1
 cfgv==3.4.0
 cfn-lint==1.39.0
@@ -809,7 +809,7 @@ uritemplate==4.2.0
 urllib3==2.5.0
 userpath==1.9.2
 uuid6==2025.0.1
-uv==0.8.13
+uv==0.13.4
 # Stackable patch:
 # The original version 0.35.0 hard codes the worker timeout to 5s.
 # This has been fixed in 0.37.0 so that the value passed through from Airflow

diff --git a/airflow/stackable/constraints/3.2.2/constraints-python3.14.txt b/airflow/stackable/constraints/3.2.2/constraints-python3.14.txt
@@ -244,7 +244,7 @@ cachetools==7.1.4
 cadwyn==6.2.2
 cattrs==26.1.0
 celery==5.6.3
-certifi==2026.5.20
+certifi==2026.10.23
 cffi==2.0.0
 chardet==6.0.0.post1
 charset-normalizer==3.4.7
@@ -660,7 +660,7 @@ universal_pathlib==0.3.10
 uritemplate==4.2.0
 urllib3==2.7.0
 uuid6==2025.0.1
-uv==0.11.16
+uv==0.13.4
 uvicorn==0.47.0
 uvloop==0.22.1
 validators==0.35.0

diff --git a/airflow/stackable/constraints/3.3.2/constraints-python3.14.txt b/airflow/stackable/constraints/3.3.2/constraints-python3.14.txt
@@ -247,7 +247,7 @@ cadwyn==7.0.0
 capi_param_builder_python==1.3.0
 cattrs==26.2.0
 celery==5.6.3
-certifi==2026.7.22
+certifi==2026.10.23
 cffi==2.1.1
 chardet==7.6.0
 charset-normalizer==3.5.1
@@ -684,7 +684,7 @@ universal_pathlib==0.3.10
 uritemplate==4.2.0
 urllib3==2.7.0
 uuid6==2025.0.1
-uv==0.12.13
+uv==0.13.4
 uvicorn==0.52.4
 uvloop==0.22.1
 validators==0.35.0

diff --git a/opensearch-dashboards/Dockerfile b/opensearch-dashboards/Dockerfile
@@ -344,6 +344,12 @@ USER ${STACKABLE_USER_UID}
 ENV HOME=${HOME}
 ENV OPENSEARCH_DASHBOARDS_HOME=${OPENSEARCH_DASHBOARDS_HOME}
 ENV PATH="${PATH}:/${OPENSEARCH_DASHBOARDS_HOME}:${OPENSEARCH_DASHBOARDS_HOME}/bin"
+# Node.js uses its own bundled copy of the Mozilla root certificates instead of the system trust store.
+# Use the system trust store instead, so Node.js does not trust the compromised
+# "emSign ECC Root CA - G3" root certificate (GHSA-6q48-6c7w-9gw2), which the system trust store no longer contains.
+# See https://nodejs.org/docs/latest-v20.x/api/cli.html#--use-bundled-ca---use-openssl-ca
+# and https://nodejs.org/docs/latest-v20.x/api/cli.html#node_optionsoptions
+ENV NODE_OPTIONS="--use-openssl-ca"
 
 WORKDIR ${OPENSEARCH_DASHBOARDS_HOME}
 CMD ["opensearch-dashboards-docker-entrypoint.sh"]
diff --git a/spark-connect-client/Dockerfile b/spark-connect-client/Dockerfile
@@ -52,4 +52,10 @@ RUN pip install --no-cache-dir --user \
   "scikit-learn==${SCIKIT_LEARN_VERSION}" \
   "matplotlib==${MATPLOTLIB_VERSION}"
 
+# grpcio uses its own bundled roots.pem instead of the system trust store.
+# Point it to the system trust store, so it does not trust the compromised
+# "emSign ECC Root CA - G3" root certificate (GHSA-6q48-6c7w-9gw2), which the system trust store no longer contains.
+# See https://github.com/grpc/grpc/blob/master/doc/environment_variables.md
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/pki/tls/certs/ca-bundle.crt
+
 WORKDIR /stackable
diff --git a/superset/boil-config.toml b/superset/boil-config.toml
@@ -25,7 +25,7 @@ authlib-version = "1.2.1"
 # and upstream CI tests 3.10 and 3.11 (https://github.com/apache/superset/blob/4.1.4/.github/actions/setup-backend/action.yml)
 python-version = "3.11"
 # Independent of Superset, use the latest release: https://github.com/astral-sh/uv/releases
-uv-version = "0.11.18"
+uv-version = "0.13.4"
 # https://github.com/apache/superset/blob/4.1.4/superset-frontend/.nvmrc
 nodejs-version = "18.20.1"
 # The latest 10.x release. 11.x requires Node ^20.17.0 || >=22.9.0.
@@ -57,7 +57,7 @@ authlib-version = "1.2.1"
 # and a py312 image variant is published. We use 3.12
 python-version = "3.12"
 # Independent of Superset, use the latest release: https://github.com/astral-sh/uv/releases
-uv-version = "0.11.18"
+uv-version = "0.13.4"
 # https://github.com/apache/superset/blob/6.1.0/superset-frontend/.nvmrc
 nodejs-version = "22.22.0"
 # superset-frontend requires npm ^10.8.1 (https://github.com/apache/superset/blob/6.1.0/superset-frontend/package.json,

diff --git a/superset/stackable/constraints/4.1.4/constraints.txt b/superset/stackable/constraints/4.1.4/constraints.txt
@@ -38,7 +38,7 @@ cattrs==23.2.3
     # via requests-cache
 celery==5.4.0
     # via apache-superset
-certifi==2024.2.2
+certifi==2026.10.23
     # via requests
 cffi==1.16.0
     # via

diff --git a/superset/stackable/constraints/6.1.0/constraints.txt b/superset/stackable/constraints/6.1.0/constraints.txt
@@ -49,7 +49,7 @@ cattrs==25.1.1
     # via requests-cache
 celery==5.5.2
     # via apache-superset (pyproject.toml)
-certifi==2025.6.15
+certifi==2026.10.23
     # via
     #   requests
     #   selenium

diff --git a/typos.toml b/typos.toml
@@ -48,3 +48,6 @@ vertica = "vertica"
 # Maven profile activation flag, as in `mvn -Prelease` (hbase/hbase/Dockerfile).
 # It sits inside a RUN continuation, where a trailing comment would break the line.
 Prelease = "Prelease"
+# Python package with Mozilla's root certificates, referenced in Dockerfiles,
+# boil-config.toml files and CHANGELOG.md.
+certifi = "certifi"