Pull Request №462 RosettaCommons/RFdiffusion/main ← RosettaCommons/RFdiffusion/fix/uv_pip_certificates
Merge: 86507b6538f51fce57b5a72477165f03999ed7ae←9a08da6d229899eb6aa610fc2f8f75c3330e90f8
Avoid vulnerable pip; use uv and newer certifi
----------------
Merge commit message:
Avoid vulnerable pip; use uv and newer certifi
No pip release supporting Python 3.9 includes the fix for the October 2026 emSign CA certificate incident (the fixed pip needs Python 3.10+).
Dockerfile: install uv 0.13.6 and use it instead of pip for all package installs, add ca-certificates, and pin certifi>=2026.10.19 and numpy<2.
env/SE3nv.yml: require certifi>=2026.10.19 in the conda pip section.
README: add a note explaining how to run the pip install steps with uv 0.13.4+ inside the conda environment.
Also removes trailing whitespace on the apt-get line in the Dockerfile.
These changes are due to the security issue outlined here: https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576