[lelia]

Updates the Docker image so its TLS clients stop trusting the eMudhra intermediate CAs whose keys were disclosed on 2026-10-20 (details), and makes CI check that on both architectures. Ships in 2.11.2 with the Coana bump from #417. Companion to SocketDev/socket-basics#128.

Root Cause

The image's trust stores predate the distrust:

• Alpine ca-certificates from the base image (curl, git, Go, Java). apk add doesn't upgrade packages the base image already has.
• Node, used by Coana and the Socket npm CLI. Node fixed this in 22.23.4 / 24.22.1, but the image installed Alpine's nodejs package, which is still 24.18.1 on every Alpine branch.
• uv 0.10.4's bundled roots.
• certifi 2025.11.12 (Python requests). Already fixed on main by chore(deps): bump certifi from 2025.11.12 to 2026.10.19 #414.

Fix

• Dockerfile: upgrade ca-certificates and fail the build below 20261020-r0.
• Dockerfile: copy Node, npm, corepack and yarn from node:24-alpine3.24 instead of apk add nodejs npm yarn, and fail the build below Node 24.22.1. Same major version as before, and Dependabot now tracks it. An earlier revision of this PR set NODE_OPTIONS=--use-openssl-ca instead; that's gone.
• Dockerfile: uv 0.13.4.
• dependency-review.yml: dockerfile-smoke builds on native amd64 and arm64 runners (it was amd64 only, with no checks). It now checks that the bundled tools run, that curl, Node and Python requests reject the eMudhra test hosts with a certificate error, and that api.socket.dev, npm and PyPI still connect. It also runs when scripts/docker-entrypoint.sh changes.
• CHANGELOG.md: adds this fix to the unreleased 2.11.2 entry.

Alpine's go package is still 1.26.9, so scanners will keep flagging it until Alpine updates. Its TLS uses the fixed system store.

Testing

socketdev/cli:pr-415 is socketdev/cli:latest plus this PR's wheel, so it doesn't include these Dockerfile changes. Instead:

• dockerfile-smoke builds the real Dockerfile on both architectures and runs the checks above. Against socketdev/cli:latest (2.11.1), the TLS check fails, as it should.
• Locally, on both architectures: Node 24.22.1, npm 11.19.1, yarn 1.22.22; no Alpine nodejs/npm/yarn. A --reach scan of a small npm fixture (lodash 4.17.20 calling _.template) runs Coana 15.12.11, finds 5 vulnerabilities (2 reachable) and uploads the full scan.
• pytest (580 passed). The TestPyPI preview socketsecurity==2.11.2.dev3966658374001 installs in a clean venv.

Public Changelog

The CLI and every tool in the socketdev/cli Docker image now reject certificates issued from the compromised eMudhra intermediate CAs.

---

Note

High Risk
Security-critical TLS trust-store and Node sourcing changes in the release image; incorrect pinning could break legitimate HTTPS or leave compromised CAs trusted.

Overview
Stops trusting compromised eMudhra intermediate CAs in the published Docker image and adds CI to prove TLS clients reject them on both release architectures.

The Dockerfile now forces ca-certificates ≥ 20261020-r0, copies Node 24.22.1+ (and npm/yarn) from node:24-alpine instead of Alpine’s lagging nodejs package, and bumps bundled uv to 0.13.4. CHANGELOG documents the 2.11.2 security fix (including certifi noted there).

dependency-review expands dockerfile-smoke: native amd64/arm64 matrix, smoke checks for bundled tools, strict rejection of eMudhra test hosts via curl/Node/Python requests, and sanity curls to api.socket.dev, npm, and PyPI. The job also runs when scripts/docker-entrypoint.sh changes.

^{Reviewed by Cursor Bugbot for commit f73c587. Configure here.}

[github-actions]

🐳 Docker preview published: socketdev/cli:pr-415

This mutable tag is only created when a Docker preview is explicitly requested.

[cursor]

Stale Bugbot comment from a previous run.

[lelia]

bugbot run

[cursor]

Stale Bugbot comment from a previous run.

[github-actions]

🚀 CLI preview published: socketsecurity==2.11.2.dev3966658374001

pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==2.11.2.dev3966658374001

TestPyPI's package index can take several minutes to expose a newly uploaded version.

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f73c587. Configure here.}