[Thomas A Caswell (tacaswell)]

Update locked packages and GitHub Actions to versions fixed for the emSign CA incident.

• Require Pixi >= 0.82.1
  Pixi 0.82.1 is the release fixed for the emSign CA incident.
  • pixi.toml: requires-pixi None -> '>=0.82.1' (added)
• Update ca-certificates, certifi, nodejs, pip in pixi.lock
  Update the locked packages to versions fixed for the emSign CA incident.
  Output of pixi update --manifest-path pixi.toml ca-certificates certifi nodejs pip:

   WARN The package `ophyd-async==0.21.1` does not have an extra named `ca`
  Environment: default
    ~ (conda) ca-certificates            2026.7.22 hbd8a1cb_0    ->  2026.10.23 hbd8a1cb_0
    ~ (conda) pip                        26.2.1 pyh145f28c_0     ->  26.2.2 pyh145f28c_0
  Platform: default:linux-64-glibc-2-17
    ~ (conda) certifi                    2026.7.22 pyhd8ed1ab_0  ->  2026.10.23 pyhd8ed1ab_0
  Platform: default:osx-arm64
    ~ (conda) brotli                     1.2.0 hf00d406_3        ->  1.2.1 hf00d406_0
    ~ (conda) brotli-bin                 1.2.0 he4a93e4_3        ->  1.2.1 he4a93e4_0
    ~ (conda) c-ares                     1.34.8 h1a92334_1       ->  1.34.9 h74c22ad_0
    ~ (conda) libbrotlicommon            1.2.0 h1dcdb26_3        ->  1.2.1 h1dcdb26_0
    ~ (conda) libbrotlidec               1.2.0 h5295a6a_3        ->  1.2.1 h5295a6a_0
    ~ (conda) libbrotlienc               1.2.0 h2ddc9cb_3        ->  1.2.1 h2ddc9cb_0
    ~ (conda) libsqlite                  3.53.4 hca69786_1       ->  3.54.1 hca69786_0
  
  Environment: dev
    ~ (conda) ca-certificates            2026.7.22 hbd8a1cb_0    ->  2026.10.23 hbd8a1cb_0
    ~ (conda) certifi                    2026.7.22 pyhd8ed1ab_0  ->  2026.10.23 pyhd8ed1ab_0
    ~ (conda) pip                        26.2.1 pyh145f28c_0     ->  26.2.2 pyh145f28c_0
  Platform: dev:osx-arm64
    ~ (conda) brotli                     1.2.0 hf00d406_3        ->  1.2.1 hf00d406_0
    ~ (conda) brotli-bin                 1.2.0 he4a93e4_3        ->  1.2.1 he4a93e4_0
    ~ (conda) brotli-python              1.2.0 py313h3c37e74_3   ->  1.2.1 py313h3c37e74_0
    ~ (conda) c-ares                     1.34.8 h1a92334_1       ->  1.34.9 h74c22ad_0
    ~ (conda) libbrotlicommon            1.2.0 h1dcdb26_3        ->  1.2.1 h1dcdb26_0
    ~ (conda) libbrotlidec               1.2.0 h5295a6a_3        ->  1.2.1 h5295a6a_0
    ~ (conda) libbrotlienc               1.2.0 h2ddc9cb_3        ->  1.2.1 h2ddc9cb_0
    ~ (conda) libsqlite                  3.53.4 hca69786_1       ->  3.54.1 hca69786_0
    ~ (conda) nodejs                     26.6.0 h00e74ec_0       ->  26.12.1 h97d27ff_0
  Platform: dev:linux-64-glibc-2-17
    ~ (conda) nodejs                     20.20.2 h44b80ee_1      ->  20.20.2 h4dda4d0_2
  
  Environment: docs
    ~ (conda) ca-certificates            2026.7.22 hbd8a1cb_0    ->  2026.10.23 hbd8a1cb_0
    ~ (conda) certifi                    2026.7.22 pyhd8ed1ab_0  ->  2026.10.23 pyhd8ed1ab_0
    ~ (conda) pip                        26.2.1 pyh145f28c_0     ->  26.2.2 pyh145f28c_0
  Platform: docs:osx-arm64
    ~ (conda) brotli                     1.2.0 hf00d406_3        ->  1.2.1 hf00d406_0
    ~ (conda) brotli-bin                 1.2.0 he4a93e4_3        ->  1.2.1 he4a93e4_0
    ~ (conda) brotli-python              1.2.0 py313h3c37e74_3   ->  1.2.1 py313h3c37e74_0
    ~ (conda) c-ares                     1.34.8 h1a92334_1       ->  1.34.9 h74c22ad_0
    ~ (conda) libbrotlicommon            1.2.0 h1dcdb26_3        ->  1.2.1 h1dcdb26_0
    ~ (conda) libbrotlidec               1.2.0 h5295a6a_3        ->  1.2.1 h5295a6a_0
    ~ (conda) libbrotlienc               1.2.0 h2ddc9cb_3        ->  1.2.1 h2ddc9cb_0
    ~ (conda) libsqlite                  3.53.4 hca69786_1       ->  3.54.1 hca69786_0
  

• Update GitHub Actions for the emSign CA incident
  • .github/workflows/cd.yml:57: pypa/gh-action-pypi-publish ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e -> 7245906fb6 # v1.14.3
• MNT: bump minimum glibc to 2.28

[Copilot]

🟡 Changes recommended

The lockfile’s glibc 2.17 platform does not match the manifest’s new glibc 2.28 target and must be regenerated.

1 open issue

• Regenerate pixi.lock for the glibc 2.28 baseline · New

What changed in this PR

This PR addresses the emSign CA incident by updating the project’s Pixi environments and PyPI publishing action.

Changes:

• Requires Pixi ≥0.82.1 and raises the Linux glibc baseline to 2.28.
• Updates locked certificate bundles, pip, Node.js, and related dependencies.
• Updates the pinned PyPI publishing action to v1.14.3.

File	Description
pixi.toml	Sets minimum Pixi and Linux glibc requirements.
pixi.lock	Refreshes security-related packages and dependency metadata.
.github/​workflows/​cd.yml	Pins the updated PyPI publishing action.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The requirements align with the reviewed lockfile context, and the publishing action update has no identified blocking issues.

1 open issue

• Regenerate pixi.lock for the glibc 2.28 baseline

_{Review effort: Balanced}

[Thomas A Caswell (tacaswell)]

releaseing the glibc caused a lot of updates.

[Thomas A Caswell (tacaswell)]

I do not think this requires an update to the beamline profile as these envs are used for testing/dev and the cdi-profile-collection repo takes care of the run-time versions

[Copilot]

🟢 Approval recommended

The reviewed changes align with the intended remediation, with no identified blocking issues.

No open issues 🎉

1 resolved since last review

• Regenerate pixi.lock for the glibc 2.28 baseline

_{Review effort: Balanced}