https://github.com/Grunet/cloud-native-honeypot/security/dependabot/1 has more details, copied below:
"Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. These are in the process of being removed from Mozilla's trust store.
e-Tugra's root certificates are being removed pursuant to an investigation prompted by reporting of security issues in their systems. Conclusions of Mozilla's investigation can be found here."
Given that this has to do with CAs I'm assuming moto
doesn't have any usage of the functionality since it's a mocking library, and certifi
is just getting pulled in because moto
depends on requests
which depends on certifi
.
Also moto is only a dev dependency.
The only thing that needs to be changed is the version of certifi
being pulled in, so presumably uninstalling moto
and resinstalling it would cause the latest version (released on 7/22) to pull in.
Since that's a little recent and it's not urgent, tackling this as part of the next monthly maintenance probably makes sense