v2.52.0 (the trust store fix, and credentials that stay out of settings.json)

v2.52.0 (the trust store fix, and credentials that stay out of settings.json)

One critical dependency fix and three features. Upgrade for the first.

• Security: the bundled trust store drops compromised roots. CertMate's outbound TLS, including ACME-over-HTTPS to the certificate authority, trusted a certifi that shipped emSign root CAs whose intermediate signing keys were compromised (GHSA-6q48-6c7w-9gw2, critical). certifi moves to 2026.10.19, the release that removes them. Every deployment should upgrade.
• Storage backend credentials can be secret references. The credential a storage backend needs (the HashiCorp Vault or OpenBao token, the Azure or Infisical client secret, the AWS keys) can be given as <field>_file (a mounted file path) or <field>_env (an environment variable) instead of a literal in settings.json, read fresh each time, the way the DNS provider tokens and the OIDC client secret already work. See docs/storage.md.
• The MCP server is on npm. npx certmate-mcp-server runs it with no local build or checkout (#1017).
• Client certificates default to the deployment's organisation and unit. A new client certificate takes its O and OU from the deployment's configured values, mirroring the country and state defaults added earlier.

Under the hood: coverage now measures through sys.monitoring with the test toolchain pinned, and the CI action set and the Python 3.14 leg were updated.

The API contract is unchanged (2.56).