GHSA-hq85-5cpj-mr62

Affected versions of the uv package are vulnerable to Improper Certificate Validation due to a compromised root certificate being included in its vendored trust store. The bundled `webpki-root-certs` copy used for TLS verification trusts the `emSign ECC Root CA - G3` root, under which eight eMudhra intermediate CA certificates with compromised private keys were issued and later revoked, yet uv continues to accept certificates chaining to this root by default. An attacker in possession of one of the compromised intermediate keys can forge valid-looking TLS certificates for arbitrary hostnames and perform man-in-the-middle attacks against uv's network connections, intercepting or tampering with package downloads and other HTTPS traffic.