TL;DR:

The very urgent uv/certifi/etc releases (and yet-to-be-done bun release) are about removing the compromised CAs as described here:

https://emudhra.we-have-a-problem.com/

In other words, that software bundled the compromised certs into the binary, so upgrading it is the only way to remove them.

This is about Go proactively blocking intermediates. Which shouldn't strictly be necessary as long as your OS has removed or distrusted the CAs (on my laptop, macOS has done that, although it seems like it did so in a way not all tools have access to; for example, rustls-platform-verifier respects it, but rustls-webpki still loads the bad CAs from the system trust store).

edit: forgot I can't use code blocks on HN

> edit: forgot I can't use code blocks on HN

  You can, two space at the start of each line

I wonder if they made this change with an assumption that the root CAs wouldn't be distrusted later same day, too.