1.2.1

Important

This release addresses the eMudhra intermediate CA certificates compromise: all deployments should upgrade. For security announcements, we encourage adopters to subscribe to the security-announce@roost.tools mailing list.

Eight intermediate CA certificates issued under eMudhra's emSign ECC Root CA - G3 have compromised private keys, and the CA has revoked them. This release updates the certifi package to 2026.10.19 to remove the compromised certificates from its bundled trust store. See GHSA-6q48-6c7w-9gw2 for details.

The risk is believed to be low but real: an attacker would need one of the compromised keys and a position on the network path of Osprey's outbound TLS calls, such as those to third-party APIs. We recommend all deployments upgrade.

New Contributors

• @honestlywhoknows made their first contribution in #536
• @emma-green made their first contribution in #540

Full Changelog: 1.2.0...1.2.1