From 3f4de68adc846a5493ef60babcf179bc2a9c2528 Mon Sep 17 00:00:00 2001
From: furedea <132188853+furedea@users.noreply.github.com>
Date: Mon, 9 Nov 2026 23:29:53 +0900
Subject: [PATCH] fix(nix): build CPython 3.14.10 for the ssl eMudhra denylist

3.14.10 is the first release whose ssl module denylists the compromised
eMudhra intermediates. Raise requires-python to match.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 nix/python.nix | 10 +++++-----
 pyproject.toml |  2 +-
 uv.lock        |  2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/nix/python.nix b/nix/python.nix
index 855215c..583c3c0 100644
--- a/nix/python.nix
+++ b/nix/python.nix
@@ -4,15 +4,15 @@
   python314,
 }:
 
-# TODO: Drop this and use pkgs.python314 once the nixpkgs input has >= 3.14.9.
-# 3.14.9 replaces the compromised emSign root in the bundled pip/certifi CA store.
-# nixpkgs' mimetypes patch no longer applies to 3.14.9's `knownfiles`, so the same
+# TODO: Drop this and use pkgs.python314 once the nixpkgs input has >= 3.14.10.
+# 3.14.10 is the first release whose `ssl` module denylists the compromised eMudhra intermediates.
+# nixpkgs' mimetypes patch no longer applies to 3.14's `knownfiles`, so the same
 # substitution is done in postPatch instead.
 (python314.override { mimetypesSupport = false; }).overrideAttrs (previousAttrs: rec {
-  version = "3.14.9";
+  version = "3.14.10";
   src = fetchurl {
     url = "https://www.python.org/ftp/python/${version}/Python-${version}.tar.xz";
-    hash = "sha256-4C2awhzr2m5GQ1NpdEqSxlzHzYZpaXaUEiz5f/rNHlM=";
+    hash = "sha256-3kFKVxGavvUnhNiZPjQdU67WNfwrBcJgfZ+YosW3IDI=";
   };
 
   postPatch = (previousAttrs.postPatch or "") + ''
diff --git a/pyproject.toml b/pyproject.toml
index 2d116af..2ac0c3b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -3,7 +3,7 @@ name = "template-python"
 version = "0.1.0"
 description = ""
 readme = "README.md"
-requires-python = ">= 3.14.9, < 3.15"
+requires-python = ">= 3.14.10, < 3.15"
 dependencies = []
 
 [tool.hatch.build.targets.wheel]
diff --git a/uv.lock b/uv.lock
index a81a514..4c67734 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,6 +1,6 @@
 version = 1
 revision = 5
-requires-python = ">=3.14.9, <3.15"
+requires-python = ">=3.14.10, <3.15"
 
 [options]
 exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values.