pradystar · Oct 22, 2026 · Oct 21, 2026
diff --git a/.github/workflows/ci-tests-splunk-ao-a2a.yaml b/.github/workflows/ci-tests-splunk-ao-a2a.yaml
@@ -43,7 +43,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
         with:
-            version: "0.12.1"
+            version: "0.13.4"
             enable-cache: true
             cache-dependency-glob: "**/splunk-ao-a2a/pyproject.toml"
 

diff --git a/.github/workflows/ci-tests-splunk-ao-adk.yaml b/.github/workflows/ci-tests-splunk-ao-adk.yaml
@@ -43,7 +43,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
         with:
-            version: "0.12.1"
+            version: "0.13.4"
             enable-cache: true
             cache-dependency-glob: "**/splunk-ao-adk/pyproject.toml"
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.0]
+
 ### Added
 
 - `create_decision_evaluator()` (also `Evaluators.create_decision_evaluator`) and `DecisionEvaluator` create and
@@ -19,6 +21,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Require `certifi>=2026.10.19` and `uv>=0.13.4` (where used) to remove trust in the compromised
+  eMudhra certificate authorities (CVE-2026-111943). Update CI tooling and example certificate bundle pins.
 - `SplunkAOTracingProcessor` (OpenAI Agents) now records Responses API LLM spans, the Agents SDK
   default, as chat messages: tool calls and tool results keep their own roles instead of one JSON
   `user` message, the output is a single assistant message, and workflow/agent spans show the
@@ -227,6 +231,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   unknown before an acknowledgement and after ordinary transport or non-2xx
   failures; it is not a delivery guarantee.
 
+[0.6.0]: https://pypi.org/project/splunk-ao/0.6.0/
 [0.5.0]: https://pypi.org/project/splunk-ao/0.5.0/
 [0.4.0]: https://pypi.org/project/splunk-ao/0.4.0/
 [0.3.0]: https://pypi.org/project/splunk-ao/0.3.0/

diff --git a/examples/agent/langgraph-fsi-agent/before/poetry.lock b/examples/agent/langgraph-fsi-agent/before/poetry.lock
diff --git a/examples/agent/minimal-agent-example/requirements.txt b/examples/agent/minimal-agent-example/requirements.txt
@@ -7,7 +7,7 @@ aiohappyeyeballs==2.6.1
 aiohttp==3.14.3
 aiosignal==1.4.0
 attrs==25.1.0
-certifi==2025.1.31
+certifi==2026.10.19
 frozenlist==1.5.0
 idna==3.15
 multidict==6.1.0

diff --git a/examples/agent/startup-simulator-3000/requirements.txt b/examples/agent/startup-simulator-3000/requirements.txt
@@ -2,7 +2,7 @@ annotated-types==0.7.0
 anyio==4.9.0
 aiohttp==3.14.3
 attrs==25.3.0
-certifi==2025.4.26
+certifi==2026.10.19
 charset-normalizer==3.4.2
 distro==1.9.0
 splunk-ao
@@ -53,4 +53,4 @@ xxhash==3.5.0
 zstandard==0.23.0
 rich
 flask
-flask-cors
+flask-cors
diff --git a/examples/logging-samples/openai-responses/requirements.txt b/examples/logging-samples/openai-responses/requirements.txt
@@ -10,7 +10,7 @@ attrs==25.4.0
     # via splunk-ao
 backoff==2.2.1
     # via splunk-ao
-certifi==2026.1.4
+certifi==2026.10.19
     # via
     #   httpcore
     #   httpx

diff --git a/examples/rag/cli-rag-demo/requirements.txt b/examples/rag/cli-rag-demo/requirements.txt
@@ -7,7 +7,7 @@ aiohappyeyeballs==2.6.1
 aiohttp==3.14.3
 aiosignal==1.4.0
 attrs==25.1.0
-certifi==2025.1.31
+certifi==2026.10.19
 frozenlist==1.5.0
 idna==3.15
 multidict==6.1.0

diff --git a/examples/rag/elastic-chatbot-rag-app/requirements.txt b/examples/rag/elastic-chatbot-rag-app/requirements.txt
@@ -30,7 +30,7 @@ botocore==1.37.13
     #   s3transfer
 cachetools==5.5.2
     # via google-auth
-certifi==2025.1.31
+certifi==2026.10.19
     # via
     #   elastic-transport
     #   httpcore
@@ -532,4 +532,4 @@ opentelemetry-instrumentation-urllib3==0.52b0
 elastic-opentelemetry-instrumentation-openai==0.6.1
 
 splunk-ao
-langgraph
+langgraph
diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "splunk-ao"
-version = "0.5.0"
+version = "0.6.0"
 description = "Splunk Agent Observability SDK for Python."
 authors = [{ name = "Splunk Inc." }]
 readme = "README.md"
@@ -28,10 +28,10 @@ packages = [
 [project.optional-dependencies]
 langchain = ["langchain-core", "langchain", "langsmith (>=0.8.0)"]
 openai = ["openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "cryptography (>=50.0.0)", "mcp (>=1.27.2,<2)"]
-crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'", "aiohttp (>=3.14.1,<4); python_version < '3.14'", "cryptography (>=50.0.0)", "mcp (>=1.27.2,<2)", "pdfminer-six (>=20251107)"]
+crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.13.4); python_version < '3.14'", "aiohttp (>=3.14.1,<4); python_version < '3.14'", "cryptography (>=50.0.0)", "mcp (>=1.27.2,<2)", "pdfminer-six (>=20251107)"]
 middleware = ["starlette"]
 distributed-tracing = ["aiohttp (>=3.14.1,<4)", "opentelemetry-instrumentation-fastapi (==0.59b0)", "opentelemetry-instrumentation-starlette (==0.59b0)", "opentelemetry-instrumentation-requests (==0.59b0)", "opentelemetry-instrumentation-httpx (==0.59b0)", "opentelemetry-instrumentation-aiohttp-client (==0.59b0)"]
-all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.9.6); python_version < '3.14'", "aiohttp (>=3.14.1,<4)", "cryptography (>=50.0.0)", "mcp (>=1.27.2,<2)", "pdfminer-six (>=20251107)", "opentelemetry-instrumentation-fastapi (==0.59b0)", "opentelemetry-instrumentation-starlette (==0.59b0)", "opentelemetry-instrumentation-requests (==0.59b0)", "opentelemetry-instrumentation-httpx (==0.59b0)", "opentelemetry-instrumentation-aiohttp-client (==0.59b0)"]
+all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "uv (>=0.13.4); python_version < '3.14'", "aiohttp (>=3.14.1,<4)", "cryptography (>=50.0.0)", "mcp (>=1.27.2,<2)", "pdfminer-six (>=20251107)", "opentelemetry-instrumentation-fastapi (==0.59b0)", "opentelemetry-instrumentation-starlette (==0.59b0)", "opentelemetry-instrumentation-requests (==0.59b0)", "opentelemetry-instrumentation-httpx (==0.59b0)", "opentelemetry-instrumentation-aiohttp-client (==0.59b0)"]
 
 
 
@@ -68,11 +68,13 @@ filelock = ">=3.20.1"
 idna = ">=3.15,<4"
 python-dotenv = ">=1.2.2"
 requests = ">=2.33.0"
+# Exclude CA bundles that still trust the compromised eMudhra intermediates (CVE-2026-111943).
+certifi = ">=2026.10.19"
 # Security floor only (VULN-106433 / CVE-2026-69247): not imported directly under src/;
 # pulled in transitively via pdfminer-six (crewai/all) and mcp -> pyjwt[crypto] (openai).
 # Do not remove as "unused".
 cryptography = { version = ">=50.0.0", optional = true }
-uv = { version = ">=0.9.6", optional = true, python = ">=3.11,<3.14" }
+uv = { version = ">=0.13.4", optional = true, python = ">=3.11,<3.14" }
 mcp = { version = ">=1.27.2,<2", optional = true }
 pdfminer-six = { version = ">=20251107", optional = true }
 

diff --git a/splunk-ao-a2a/CHANGELOG.md b/splunk-ao-a2a/CHANGELOG.md
@@ -2,6 +2,21 @@
 
 ## Unreleased
 
+## 0.2.0
+
+### Changed
+
+- Raised the `python-dotenv` minimum version to `1.2.2` for the optional
+  examples dependencies.
+
+### Security
+
+- Require `uv>=0.13.4` for development and use `uv 0.13.4` in CI, which
+  removes trust in the compromised eMudhra certificate authorities
+  (CVE-2026-111943).
+
+## 0.1.0 - 2026-07-31
+
 ### Added
 
 - Added automatic OpenTelemetry instrumentation for A2A client and server

diff --git a/splunk-ao-a2a/pyproject.toml b/splunk-ao-a2a/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "splunk-ao-a2a"
-version = "0.1.0"
+version = "0.2.0"
 description = "Splunk AO observability auto-instrumentation for A2A (Agent-to-Agent) protocol"
 readme = "README.md"
 requires-python = ">=3.11,<3.15"
@@ -26,7 +26,7 @@ Repository = "https://github.com/splunk/splunk-ao-python"
 
 # UV-specific configuration (path for dev, ignored when installed from PyPI)
 [tool.uv]
-required-version = ">=0.9.6"
+required-version = ">=0.13.4"
 sources = { "splunk-ao" = { path = "../", editable = true } }
 
 [dependency-groups]

diff --git a/splunk-ao-a2a/src/splunk_ao_a2a/_version.py b/splunk-ao-a2a/src/splunk_ao_a2a/_version.py
@@ -1 +1 @@
-__version__ = "0.1.0"
+__version__ = "0.2.0"
diff --git a/splunk-ao-adk/CHANGELOG.md b/splunk-ao-adk/CHANGELOG.md
@@ -2,6 +2,24 @@
 
 ## Unreleased
 
+## 0.2.0
+
+### Added
+
+- Capture the image/audio token breakdown that Gemini reports in
+  `prompt_tokens_details` / `candidates_tokens_details` on LLM spans, so
+  per-modality pricing applies to the span's cost. Carry the counts through
+  both the OpenTelemetry and compatibility ingestion-hook paths. Missing or
+  unreadable breakdowns remain unknown without dropping the LLM span.
+
+### Security
+
+- Require `uv>=0.13.4` for development and use `uv 0.13.4` in CI, which
+  removes trust in the compromised eMudhra certificate authorities
+  (CVE-2026-111943).
+
+## 0.1.0 - 2026-07-31
+
 ### Added
 
 - Added automatic tracing for Google ADK agent runs, model calls, tool calls,
@@ -15,6 +33,3 @@
 - Retained the proprietary ingestion hook as deprecated migration
   compatibility; new custom pipelines should use OpenTelemetry extension
   points.
-- Captures the image/audio token breakdown that Gemini reports in
-  `prompt_tokens_details` / `candidates_tokens_details` on LLM spans, so
-  per-modality pricing applies to the span's cost.
diff --git a/splunk-ao-adk/pyproject.toml b/splunk-ao-adk/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "splunk-ao-adk"
-version = "0.1.0"
+version = "0.2.0"
 description = "Splunk AO observability integration for Google ADK"
 readme = "README.md"
 requires-python = ">=3.11,<3.15"
@@ -24,7 +24,7 @@ Repository = "https://github.com/splunk/splunk-ao-python"
 
 # UV-specific configuration (path for dev, ignored when installed from PyPI)
 [tool.uv]
-required-version = ">=0.9.6"
+required-version = ">=0.13.4"
 sources = { "splunk-ao" = { path = "../", editable = true } }
 
 [tool.hatch.build.targets.wheel]

diff --git a/splunk-ao-adk/src/splunk_ao_adk/__init__.py b/splunk-ao-adk/src/splunk_ao_adk/__init__.py
@@ -1,4 +1,4 @@
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 
 from splunk_ao_adk.callback import SplunkAOADKCallback
 from splunk_ao_adk.decorator import splunk_ao_retriever

diff --git a/src/splunk_ao/__init__.py b/src/splunk_ao/__init__.py
@@ -93,7 +93,7 @@
 from splunk_ao.types import MetricSpec
 from splunk_ao.utils.log_config import enable_console_logging
 
-__version__ = "0.5.0"
+__version__ = "0.6.0"
 
 __all__ = [
     # Stable / unchanged