QDT 0.48.0: security fix for all previous versions and various improvements and fixes

QGIS QGIS-QDT
,
1

Hi all,

QDT 0.48.0 is out (release, changelog). Unlike the previous ones, this release is mainly driven by security: all previous versions are affected, so please plan the rollout on your fleets.

:locked: Security fix: compromised CA certificates

As many other projects, QDT now requires certifi >= 2026.10.19, which removes the emSign root certificates compromised in the eMudhra incident. Earlier versions are exposed to man-in-the-middle attacks on every HTTPS download QDT performs: scenarios, profiles, plugins and upgrade.

Details and workarounds are in the advisory GHSA-g43m-g8h7-cjcp.

As a reminder, fixes (security included) are only published on the latest version. That’s why 0.48.0 also ships everything merged since 0.47.0.

:clipboard: Before rolling it out

Check your scenarios:

  • declare at least one job
  • use a non-empty uses key for every step
  • do not rely on the action option of qplugins-synchronizer, now deprecated (non-blocking error in 0.49, removal in 0.50). Use the cleanup-manager job to remove plugins.

Other changes

  • plugins synchronizer: downloaded profiles lookup is now scoped to the running scenario
  • rules: results are cached instead of profile objects
  • scenario: metadata.description is really optional and an empty settings section is handled
  • packaging: dulwich is now shipped in its pure Python version, so the executables no longer embed unsigned binaries
  • docs: consolidated QDT profile reference and link to the slides of the QGIS UC 2026 talk in Laax.

Installation & Upgrade

:warning: Do not use qdt upgrade from a previous version:
that download would go through the outdated CA bundle. Get the new version directly instead.

# if you use pipx
pipx upgrade qgis-deployment-toolbelt
# if you use pip (upgrade pip first, it ships its own certifi copy)
python -m pip install --upgrade pip
python -m pip install --upgrade "qgis-deployment-toolbelt[completion]"

Using the executable: download it from the release page and redeploy it through your usual channel (GPO, SCCM, Intune…).

Special Thanks :raising_hands:

This release was mainly funded by la métropole du Grand Lyon, who continues to support the QDT development, developed and funded (for security) by Oslandia and with the great help from @nicogodet.

Questions or feedback? Join the discussion on GitHub or open an issue.

1 Like