Hotfix/emudhra ca go toolchain

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: '1.26.x'
+        go-version: '1.27.x'
         cache-dependency-path: 'qpi-ui/go.sum'
 
     - name: Set up uv
@@ -69,7 +69,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: '1.26.x'
+        go-version: '1.27.x'
         cache-dependency-path: 'qpi-ui/go.sum'
 
     - name: Set up uv
@@ -137,7 +137,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: '1.26.x'
+        go-version: '1.27.x'
         cache-dependency-path: 'qpi-client/go/go.sum'
 
 
@@ -209,7 +209,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: ['1.26.x']
+        go-version: ['1.27.x']
 
     steps:
     - name: Checkout Code
@@ -265,7 +265,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: '1.26.x'
+        go-version: '1.27.x'
         cache-dependency-path: 'qpi-ui/go.sum'
 
     - name: Set up uv
@@ -315,7 +315,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: '1.26.x'
+        go-version: '1.27.x'
         cache-dependency-path: 'qpi-driver/go/go.sum'
 
     - name: Set up uv
@@ -496,7 +496,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: '1.26.x'
+        go-version: '1.27.x'
 
     - name: Set up Node.js
       uses: actions/setup-node@v4
@@ -552,7 +552,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: '1.26.x'
+        go-version: '1.27.x'
 
     - name: Set up Node.js
       uses: actions/setup-node@v4

CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project follows versions of format `{year}.{month}.{patch_number}`.
 
+## [0.4.3] - 2026-10-30
+
+### Changed
+
+- `go`: every Go module requires Go 1.27.3 and CI builds on 1.27.x, so nothing is built with
+  a toolchain that still trusts the compromised eMudhra intermediate CAs (CVE-2026-111943,
+  fixed in Go 1.27.3 and 1.26.10). A binary built before this keeps trusting certificates
+  issued from the leaked keys until it is rebuilt.
+- `qpi-client/py`, `qpi-driver/py`: certifi moves to 2026.10.23, which drops three of the
+  four eMudhra roots — `emSign ECC Root CA - G3` among them. The pinned 2026.5.20 bundle
+  still trusted them, and Go's denylist covers only Go.
+
+### Fixed
+
+- `qpi-driver/py`: `install-systemd.sh` lets uv take a prerelease only where no release will
+  do. `--prerelease allow`, there for the qblox extra, applied to every package and pulled in a
+  pynng beta whose wheel wants a `libatomic` stock Ubuntu has not got — so the driver it
+  installed died on `import pynng` before it could start.
+- `qpi-ui`: pocketbase moves to 0.40.6. Built with Go 1.27, which turns `encoding/json/v2`
+  on, 0.39.2's `Collection.UnmarshalJSON` recursed into itself, so the server died of a stack
+  overflow on the first collection it decoded and every request after that was refused.
+
 ## [0.4.2] - 2026-08-16
 
 ### Added

Makefile

@@ -1,4 +1,4 @@
-VERSION ?= 0.4.2
+VERSION ?= 0.4.3
 UV := $(shell command -v uv 2> /dev/null || echo "$$HOME/.local/bin/uv")
 EXECUTOR ?= mock
 EXECUTORS := mock aer quantify qblox

README.md

@@ -77,12 +77,12 @@ The server is available as a single executable binary, as well as native OS pack
 #### Standalone Binary (macOS & Linux)
 Download the binary for your platform, make it executable, and run:
 ```bash
-# macOS (replace 0.4.2 with the version you wish to install)
-curl -LO https://github.com/sopherapps/qpi/releases/download/v0.4.2/qpi-0.4.2-darwin-amd64
-chmod +x qpi-0.4.2-darwin-amd64 && mv qpi-0.4.2-darwin-amd64 qpi
+# macOS (replace 0.4.3 with the version you wish to install)
+curl -LO https://github.com/sopherapps/qpi/releases/download/v0.4.3/qpi-0.4.3-darwin-amd64
+chmod +x qpi-0.4.3-darwin-amd64 && mv qpi-0.4.3-darwin-amd64 qpi
 
 # Linux (standalone binary)
-curl -L https://github.com/sopherapps/qpi/releases/download/v0.4.2/qpi-0.4.2-linux-amd64.tar.gz | tar -xz
+curl -L https://github.com/sopherapps/qpi/releases/download/v0.4.3/qpi-0.4.3-linux-amd64.tar.gz | tar -xz
 
 # Start the server
 ./qpi serve
@@ -91,8 +91,8 @@ curl -L https://github.com/sopherapps/qpi/releases/download/v0.4.2/qpi-0.4.2-lin
 #### Native Linux Packages (Ubuntu, Debian, Fedora, Alpine)
 For Debian/Ubuntu, download and install the `.deb` package:
 ```bash
-wget https://github.com/sopherapps/qpi/releases/download/v0.4.2/qpi_0.4.2_amd64.deb
-sudo apt install ./qpi_0.4.2_amd64.deb
+wget https://github.com/sopherapps/qpi/releases/download/v0.4.3/qpi_0.4.3_amd64.deb
+sudo apt install ./qpi_0.4.3_amd64.deb
 ```
 *(Note: Installing the package automatically registers and starts `qpi.service` under systemd (or OpenRC on Alpine) to run the server in the background on port `8090`)*
 

e2e/go.mod

@@ -1,6 +1,6 @@
 module smoke
 
-go 1.21
+go 1.27.3
 
 replace github.com/sopherapps/qpi/qpi-client/go => ../qpi-client/go
 

qpi-client/go/go.mod

@@ -1,3 +1,3 @@
 module github.com/sopherapps/qpi/qpi-client/go
 
-go 1.21
+go 1.27.3

qpi-client/js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qpi-client",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "JavaScript/TypeScript client SDK for the QPI quantum computing platform",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

qpi-client/py/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "qpi-client"
-version = "0.4.2"
+version = "0.4.3"
 description = "Python client SDK for the QPI quantum computing platform"
 readme = "README.md"
 license = {text = "MIT"}

qpi-client/py/qpi_client/__init__.py

@@ -30,7 +30,7 @@
 try:
     __version__ = importlib.metadata.version("qpi-client")
 except importlib.metadata.PackageNotFoundError:
-    __version__ = "0.4.2"
+    __version__ = "0.4.3"
 
 from qpi_client.client import QPIClient
 from qpi_client.provider import QPIBackend, QPIJob

qpi-driver/go/cli/cli.go

@@ -27,7 +27,7 @@ import (
 
 // Version is the CLI version; overridable at build time with
 // -ldflags "-X github.com/sopherapps/qpi/qpi-driver/go/cli.Version=…".
-var Version = "0.4.2"
+var Version = "0.4.3"
 
 // commonFlags are the universal options `start` shares across every operation,
 // mirroring the Python CLI. A device's own settings go through -o instead.

qpi-driver/go/go.mod

@@ -1,6 +1,6 @@
 module github.com/sopherapps/qpi/qpi-driver/go
 
-go 1.21
+go 1.27.3
 
 require (
 	github.com/spf13/cobra v1.8.1

qpi-driver/js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qpi-driver",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "TypeScript/JavaScript SDK for building QPI quantum platform drivers",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

qpi-driver/py/install-systemd.sh

@@ -124,7 +124,10 @@ else
     else
         VERSION_SUFFIX="==$QPI_DRIVER_VERSION"
     fi
-    sudo -u "$REAL_USER" "$UV_PATH" tool install --python 3.12 --prerelease allow "qpi-driver[cli,${DEVICE}]${VERSION_SUFFIX}"
+    # `if-necessary`, not `allow`: the qblox extra needs prereleases, but `allow`
+    # applies to every package, and it reached for a pynng beta whose wheel wants a
+    # libatomic the base image has not got. A prerelease only where no release will do.
+    sudo -u "$REAL_USER" "$UV_PATH" tool install --python 3.12 --prerelease if-necessary "qpi-driver[cli,${DEVICE}]${VERSION_SUFFIX}"
 
     QPI_DRIVER_BIN="${QPI_DRIVER_BIN:-$REAL_HOME/.local/bin/qpi-driver}"
 fi

qpi-driver/py/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "qpi-driver"
-version = "0.4.2"
+version = "0.4.3"
 description = "Quantum Processing Interface (QPI) QPU Driver"
 readme = "README.md"
 requires-python = ">=3.12,<3.13"

qpi-driver/py/qpi_driver/__init__.py

@@ -3,7 +3,7 @@
 try:
     __version__ = importlib.metadata.version("qpi-driver")
 except importlib.metadata.PackageNotFoundError:
-    __version__ = "0.4.2"
+    __version__ = "0.4.3"
 
 from qpi_driver.builtins import (
     DeviceBuilder,

qpi-driver/py/qpi_driver/cli.py

@@ -253,7 +253,7 @@ def _get_version() -> str:
         try:
             return importlib.metadata.version("qpi-driver")
         except importlib.metadata.PackageNotFoundError:
-            return "0.4.2"
+            return "0.4.3"
 
     def _banner():
         """Renders the banner at the top of the CLI"""

qpi-driver/py/tests/test_cli.py

@@ -40,7 +40,7 @@ def test_cli_version():
     try:
         expected_version = importlib.metadata.version("qpi-driver")
     except importlib.metadata.PackageNotFoundError:
-        expected_version = "0.4.2"
+        expected_version = "0.4.3"
     assert expected_version in result.stdout
 
 
@@ -418,7 +418,7 @@ def test_version_falls_back_when_the_package_is_not_installed():
         "version",
         side_effect=importlib.metadata.PackageNotFoundError("qpi-driver"),
     ):
-        assert _get_version() == "0.4.2"
+        assert _get_version() == "0.4.3"
 
 
 def test_cli_process_requires_token():