CircuitPython 10.3.2 removes compromised root certificates from bundle

Adafruit has published CircuitPython 10.3.2, a stable bugfix revision that addresses a security issue in the firmware's root certificate bundle. The update removes compromised certificates issued by eMudhra emSign and AAA Certificate Services, which had been revoked due to security incidents. This affects all boards running the stable ports, including Microchip SAMD21/SAMx5x, Espressif ESP32 variants, Nordic nRF52840/52833, Raspberry Pi RP2040/RP2350, and ST STM32F4 devices.

Users can obtain updated firmware through circuitpython.org's download page, which filters by board model and language. The release maintains the existing port stability tiers, with atmel-samd, espressif, nordic, raspberrypi, and stm ports remaining stable while alpha ports such as broadcom (slated for removal in CircuitPython 11), ESP32-P4, and Zephyr RTOS continue in early development.

Certificate security and port coverage

• Root certificate purge: The bundled root certificates have been updated to eliminate compromised eMudhra emSign and AAA Certificate Services entries, tracked as issue #11838 and contributed by Dan Halbert.
• Stable port matrix: The release certifies stability for atmel-samd (SAMD21, SAMx5x), cxd56 (Sony Spresense), espressif (ESP32 through ESP32-S3 including new C5, C61, and H2 variants), nordic (nRF52840, nRF52833), raspberrypi (RP2040, RP2350), and stm (STM32F4 family).
• Alpha port status: Eleven ports remain in alpha, including the broadcom port for Linux-capable Raspberry Pi boards which Adafruit plans to remove entirely in the upcoming CircuitPython 11 release cycle.
• No functional API changes: As a patch-level revision, 10.3.2 contains no new features or breaking changes to the Python runtime, module set, or hardware abstraction APIs.

Why it matters

For the substantial embedded Python community using CircuitPython in education, prototyping, and production IoT devices, this certificate update closes a trust-chain vulnerability that could have enabled man-in-the-middle attacks on HTTPS connections. The broad hardware coverage ensures that educators and makers across the RP2040/RP2350, ESP32, and SAMD ecosystems can deploy the fix without porting concerns, while the planned broadcom removal signals Adafruit's continued focus on resource-constrained microcontrollers rather than Linux SBCs.