[lelia]

Updates the Docker image so its TLS clients stop trusting the eMudhra intermediate CAs whose keys were disclosed on 2026-10-20 (details). Companion to SocketDev/socket-basics#128.

Root Cause

The image's CA stores predate the distrust:

• Alpine ca-certificates from the base image (curl, git, Go, Java). apk add doesn't upgrade packages the base image already has.
• certifi 2025.11.12 in uv.lock (Python requests).
• Node's bundled store (Coana, the Socket npm CLI). Node hasn't released a fix yet.
• uv 0.10.4's bundled roots.

Fix

• Dockerfile: upgrade ca-certificates and fail the build below 20261020-r0.
• uv.lock: certifi 2026.10.19.
• Dockerfile and scripts/docker-entrypoint.sh: point Node at the system store with --use-openssl-ca. The entrypoint prepends it to a caller's own NODE_OPTIONS and skips it if the caller already chose a CA store. Can be removed once Node ships a fix.
• Dockerfile: uv 0.13.4.
• Version 2.11.2 and changelog entry.

Alpine's go package is still 1.26.9, so scanners will keep flagging it until Alpine updates. Its TLS uses the fixed system store.

Testing

Built locally and ran each client against the two test hosts, dv-g3b-emudhra.we-have-a-problem.com and dv-g3b-aaa-emudhra.we-have-a-problem.com. On 2.11.1, curl, Python, Node, Go and Java accept the first. On this branch, curl, git, Python, Node, uv, Go and Java reject both. api.socket.dev, the npm registry, PyPI, proxy.golang.org, Maven Central and GitHub still connect.

Also checked the entrypoint with no NODE_OPTIONS, an empty one, a heap limit, multiple flags, and an explicit --use-bundled-ca. pytest (580 passed), uv lock --locked, hatch build and twine check pass.

Quick check against socketdev/cli:pr-415:

docker run --rm --entrypoint curl socketdev/cli:pr-415 -sS -o /dev/null -w '%{http_code}\n' https://dv-g3b-emudhra.we-have-a-problem.com/

2.11.1 prints 200; this branch fails certificate verification.

Public Changelog

The CLI and every tool in the socketdev/cli Docker image now reject certificates issued from the compromised eMudhra intermediate CAs.

---

Note

High Risk
Changes system-wide CA trust for every TLS client in the Docker image (Alpine, Python, Node, uv); misconfiguration could break legitimate HTTPS or leave distrusted chains accepted.

Overview
Release 2.11.2 hardens TLS across the socketdev/cli Docker image and Python CLI so clients no longer trust certificates chained to the compromised eMudhra intermediate CAs.

The Dockerfile now upgrades Alpine ca-certificates (with a build-time floor of 20261020-r0), sets NODE_OPTIONS=--use-openssl-ca so Node uses the patched system store until Node ships its own fix, and bumps the bundled uv image from 0.10.4 to 0.13.4 for updated root bundles. scripts/docker-entrypoint.sh prepends --use-openssl-ca when callers add their own NODE_OPTIONS, without overriding an explicit CA-store flag.

uv.lock pins certifi to 2026.10.19 for Python/requests TLS. Version strings move to 2.11.2 in pyproject.toml, socketsecurity/__init__.py, and CHANGELOG.md.

^{Reviewed by Cursor Bugbot for commit c6f5cd9. Configure here.}

[github-actions]

🐳 Docker preview published: socketdev/cli:pr-415

This mutable tag is only created when a Docker preview is explicitly requested.

[cursor]

Stale Bugbot comment from a previous run.

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c6f5cd9. Configure here.}