RCC v21.4.0 released
RCC v21.4.0 is a security release in response to the eMudhra intermediate CA compromise disclosed on 20 October 2026. The private keys of several eMudhra intermediate certificates were exposed. A TLS client that still trusts those intermediates can have its connections intercepted, including package downloads from PyPI and conda channels.
Browsers and operating systems have already blocked these intermediates. Tools that ship their own certificate handling, such as RCC and the uv installer it embeds, need their own updates. This release provides them.
We recommend upgrading. There are no functional changes and no breaking changes, so upgrading is a straight swap.
What changed
- Go 1.26.10. RCC's own HTTPS connections now reject the compromised intermediates, even when their root certificate is trusted by the system store or by a
ca-bundle.pemin your RCC profile. - Embedded uv 0.13.4 (GHSA-hq85-5cpj-mr62). uv uses its own built-in root certificates rather than the operating system's, so OS certificate updates did not protect it. uv 0.13.4 updates those built-in certificates.
The first environment build after upgrading may take longer than usual. uv 0.13 uses a new cache format, so it downloads packages again once.
If you use a custom CA bundle
If your RCC profile provides a ca-bundle.pem, RCC passes it to the tools it runs, including uv, pip and Node.js (through SSL_CERT_FILE, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE and NODE_EXTRA_CA_CERTS). Those tools trust every certificate in that bundle. Make sure your bundle does not contain the affected roots, emSign ECC Root CA - G3 and Comodo AAA Certificate Services, unless your organization needs them. If it does, regenerate it from an up-to-date source.
Your automation code does not need changes for this incident. Python packages in your robot's environment, such as certifi and pip, have their own fixes; see the Python packaging guidance.
Getting v21.4.0
Signed and pre-built executables are available directly:
macOS and Windows builds are code-signed, and the macOS build is notarized. RCC supports macOS on Apple Silicon only; Intel builds were discontinued in v21.0.0.
To check which versions you have, run rcc version and rcc configure diagnostics. The diagnostics output lists the embedded uv and micromamba versions. To test whether your network path rejects the compromised certificates, run rcc configure tlsprobe dv-g3b-noct-emudhra.we-have-a-problem.com:443. It should report a verification failure.
The complete changelog ships inside the executable itself. Run rcc docs changelog to read the full list of changes for the version you have installed.