The pypi-publish GitHub Action versions before 1.14.3 included the emSign root CA certificate via the certifi bundle, which has since been removed. This change affects the TLS trust store used by Sigstore for Trusted Publishing and Digital Attestations. The vulnerability is tracked due to the revocation of this CA in the chain that Sigstore relies on. A fix is available in version 1.14.3.