Changes.Watch~ upgrade verdicts ~
Free digest
Research1 in 10 popular npm releases needed a hotfix

critical vulnerability

pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI

Fix availableCritical · CVSS 9.3

Published Oct 30, 2026 · updated Oct 30, 2026

What to do

  1. Upgrade to a fixed version: pypa/gh-action-pypi-publish 1.14.3.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

GitHub Actionspypa/gh-action-pypi-publish

Vulnerable versions
<= 1.14.2
Fixed in
1.14.3

Check your project: grep -rn "pypa/gh-action-pypi-publish" .github/workflows

What changed

  1. Oct 30, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-295 Improper Certificate Validation

← All critical vulnerabilities