[RCmerci]

Journal currently pins ca-certs-nss 3.126. Update all six dependency declarations to the latest published stable release, 3.131.1: dune-project, the Journal and sync opam manifests, and the three affected lock files. CI's fixed opam repository snapshot is also advanced to the official commit introducing this release, 922f67e068446a8d8e809a40251a259bd0549552, so the locked version is available during CI dependency installation. Other dependency versions and TLS verification policies are unchanged.

The official release and opam metadata agree on archive SHA256 86a506cff98dc63ebec4b0ee40f60347f2829f37af56ae24f49b1bcb83c3a020. The extracted set changes from 170 to 167 roots, removing emSign ECC Root CA - G3, emSign ECC Root CA - C3, and emSign Root CA - C1; no roots are added.

Validation

Tested on main e88f2c9700ed9454a65bd21c18f5fb3fc166b76e with these six version changes:

• Built and installed the verified release into an isolated prefix; compiled the production native sync implementation and existing test executables against its archive. Link rules and executable DER checks confirm the new root collection was used.
• 305 sync tests and 31 asset tests passed.
• Four offline authenticator controls passed: normal ISRG Root X1 root path accepted; hostname mismatch, empty chain, and the removed emSign G3 root path rejected. The old bundle accepted the emSign G3 root-path control.
• Six dependency declarations agree on 3.131.1. The final diff contains those six version replacements and one necessary CI repository-snapshot replacement; whitespace checks pass.
• The build/cache helper suite completed successfully after the CI snapshot change (53 passed, 1 skipped). The production source and previously tested native dependency archive are unchanged.

Remaining security exposure

This dependency update does not fully resolve the eMudhra incident. The package still includes AAA Certificate Services: NSS marks it as trusted for email, while its server-auth status is MUST_VERIFY_TRUST. The package's generic extraction includes it, and Journal uses the resulting collection for TLS without preserving those purpose restrictions or supplying CRLs.

All six public compromised cross-signed TLS CA certificates from the Mozilla incident attachment still establish CA paths under the new collection using offline openssl verify -purpose any; the six expected CA-path rejection checks therefore fail. This establishes remaining CA paths, not a forged-leaf attack or a complete production TLS handshake reproduction. No private keys were recovered, and no user tokens, graphs, or attack sites were used.

No SPKI denylist or other trust-policy change is included. Verification covers native sync linkage and tests; no iOS app or TestFlight build was produced.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T12:12:07.436969Z	8368057	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.