chore(release): 3.4.1

CHANGELOG.md

@@ -8,6 +8,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [3.4.1] - 2026-10-21
+
+### Changed
+- Socket Python CLI 2.9.0 -> 2.11.3 in the heavy and app-tests images. 2.11.3
+  carries the same eMudhra CA fix for its own image and requires
+  `certifi>=2026.10.19` (SocketDev/socket-python-cli#415, #418).
+- Socket Python SDK 3.6.0 -> 3.6.1, which requires `certifi>=2026.10.19`.
+- Trivy 0.73.0 -> 0.76.1, upstream's release for the eMudhra compromise. It is
+  built on Go 1.27.3, which blocks the compromised intermediates in Go itself
+  and clears container scanner findings against Trivy's Go version.
+
 ### Fixed
 
 - **The images no longer trust certificates from the compromised eMudhra
@@ -16,8 +27,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   2026.10.19 or newer, and source installs (`pip install -e .`) require the same
   `certifi`. curl, git, Python `requests`, pip, Node, and the bundled Trivy and
   TruffleHog now reject those chains. Container scanners may still report
-  CVE-2026-111943 against the Trivy and TruffleHog binaries until they are
-  rebuilt on Go 1.26.10 or 1.27.3.
+  CVE-2026-111943 against the TruffleHog binary until it is rebuilt on Go
+  1.26.10 or 1.27.3.
 
 ## [3.4.0] - 2026-09-18
 

Dockerfile

@@ -15,10 +15,11 @@ ARG SOCKET_NPM_CLI_VERSION=1.1.165
 # source and published by Socket's own release pipeline. Pinned by digest; both
 # ARGs are updated together by that release process, never bumped independently.
 # Building requires pull access to the registry; contributors without it can
-# override, e.g.: docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.73.0 .
+# override, e.g.: docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.76.1 .
 # TRIVY_VERSION feeds the image label — keep it in sync with the TRIVY_IMAGE tag.
-ARG TRIVY_VERSION=0.73.0
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
+# -socket.N is a trivy-dist toolchain rebuild: same upstream source, newer Go.
+ARG TRIVY_VERSION=0.76.1
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 
 # ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
 FROM ${TRIVY_IMAGE} AS trivy

Dockerfile.heavy

@@ -4,9 +4,9 @@ ARG TRUFFLEHOG_VERSION=3.96.0
 ARG UV_VERSION=0.12.1
 ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.9.0
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.3
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 
 FROM ${TRIVY_IMAGE} AS trivy
 FROM trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} AS trufflehog

README.md

@@ -35,7 +35,7 @@ jobs:
       - name: Run Socket Basics
         # Pin to a commit SHA for supply-chain safety.
         # Dependabot will keep this up to date automatically — see docs/github-action.md.
-        uses: SocketDev/socket-basics@<sha>  # v3.4.0
+        uses: SocketDev/socket-basics@<sha>  # v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -179,10 +179,10 @@ For GitHub Actions, see the [Quick Start](#-quick-start---github-actions) above
 
 ```bash
 # Pull the pre-built image (recommended — no build step required)
-docker pull ghcr.io/socketdev/socket-basics:3.4.0
+docker pull ghcr.io/socketdev/socket-basics:3.4.1
 
 # Run scan
-docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.0 \
+docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --secrets \

action.yml

@@ -4,7 +4,7 @@ author: "Socket"
 
 runs:
   using: "docker"
-  image: "docker://ghcr.io/socketdev/socket-basics:3.4.0"
+  image: "docker://ghcr.io/socketdev/socket-basics:3.4.1"
   env:
     # Core GitHub variables (these are automatically available, but we explicitly pass GITHUB_TOKEN)
     GITHUB_TOKEN: ${{ inputs.github_token }}

app_tests/Dockerfile

@@ -13,11 +13,11 @@ ARG UV_VERSION=0.12.1
 ARG GOSEC_VERSION=v2.28.0
 ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.9.0
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.3
 #
 # NOT Dependabot-trackable — Socket-built Trivy, pinned by digest; updated by
 # Socket's trivy-dist release process. See the note in the root ./Dockerfile.
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 
 # ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
 FROM ${TRIVY_IMAGE} AS trivy
@@ -89,7 +89,13 @@ ARG SOCKET_NPM_CLI_VERSION
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     apt-get update && apt-get install -y --no-install-recommends \
-      curl git wget ca-certificates libatomic1
+      curl git wget ca-certificates libatomic1 \
+    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1
+# pip checks certificates against its own vendored CA bundle, not the system
+# store, and the base image's pip trusts the compromised intermediates. 26.2.2
+# vendors certifi 2026.10.19. Upgrade it against the system store fixed above.
+RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" \
+    && python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))'
 RUN --mount=type=cache,target=/root/.npm \
     npm install -g eslint eslint-plugin-security \
       @typescript-eslint/parser @typescript-eslint/eslint-plugin \