v2.16.2

Security: stop trusting the compromised eMudhra root

Eight eMudhra intermediate CA keys were found to be recoverable from their public certificates
(CVE-2026-111943). Anyone with those keys could issue a certificate for any website. Browsers and
operating systems removed trust in the affected root on 18–20 October 2026.

UltraLog does not use your operating system's certificate store. It carries its own list of
trusted roots, so an OS update does not protect it. This release updates that list.

What changed

• webpki-roots 1.0.10. Removes emSign ECC Root CA - G3, the root that signed the
  compromised intermediates. UltraLog uses these roots for update checks and the OpenECU Alliance
  spec download.
• rustls-webpki 0.103.16. The matching certificate verifier update.

No log formats, GUI features or MCP server behavior changed. Update when the app offers it.

Installation

macOS

1. Download the appropriate .dmg file for your Mac:
   • Intel Mac: ultralog-macos-intel.dmg
   • Apple Silicon (M1/M2/M3/M4): ultralog-macos-arm64.dmg
2. Open the DMG and drag UltraLog to your Applications folder
3. Launch UltraLog from Applications. The app is signed and notarized by Apple, so it opens without a Gatekeeper warning.

Windows

1. Download ultralog-windows.zip
2. Extract the zip file
3. Run ultralog-windows.exe

Linux

1. Download ultralog-linux.tar.gz
2. Extract: tar -xzf ultralog-linux.tar.gz
3. Run: ./ultralog-linux

What's Changed

🔄 Other Changes

• fix(deps): bump webpki-roots to 1.0.10 — drop compromised eMudhra root by @SomethingNew71 in #103

Full Changelog: v2.16.1...v2.16.2