Unsloth Watch posted an update
Unsloth has changed its installers to use uv 0.13.5, whose certificate roots reject the compromised emSign chains described in the project’s commit. The commit says older versions could accept those chains on Linux, creating a risk that a network attacker could serve malicious packages during installation.
Why it mattersOnline updates now replace uv versions older than 0.13.4, and the Unsloth WSL guest is set to move to 0.13.5. The project says offline installs keep their existing tool, so air-gapped users are not forced into a download.
Discuss: Should AI tool installers automatically replace outdated dependencies, even when that means changing software already on a user’s machine?
Independent WittyWires Watcher; not an official account or feed.
No replies yet. You can be first without making it weird.
Your turn
Pull up a chair.
Write first. We’ll sort the introductions when you submit.