Stop trusting the compromised eMudhra intermediate CAs

Require Alpine ca-certificates 20261020-r0+ in the image, bump certifi to
2026.10.19, point Node at the system store with NODE_OPTIONS=--use-openssl-ca
until Node ships its fix, and bump the bundled uv to 0.13.4.

Author: lelia

CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 2.11.2
+
+### Fixed: stop trusting the compromised eMudhra intermediate CAs
+
+- The private keys for eight eMudhra intermediate CAs leaked (disclosed
+  2026-10-20). The Docker image now requires Alpine `ca-certificates`
+  `20261020-r0` or newer, which removes the roots those intermediates chain to,
+  so `curl`, `git`, Go and Java in the image reject them.
+- `certifi` moves from `2025.11.12` to `2026.10.19`, so Python `requests` (the
+  CLI's own API calls) rejects them too.
+- The image sets `NODE_OPTIONS=--use-openssl-ca` so Node, including the
+  reachability engine and the Socket npm CLI, uses the patched system store
+  until Node ships its own fix.
+- Bumped the bundled `uv` from `0.10.4` to `0.13.4`, which ships the patched
+  `webpki-roots`.
+
 ## 2.11.1
 
 ### Changed: bump pinned Coana CLI to 15.12.10

Dockerfile

@@ -14,9 +14,14 @@ ARG PIP_EXTRA_INDEX_URL=https://pypi.org/simple
 ARG USE_LOCAL_INSTALL=false
 
 # Install base packages first
+# ca-certificates must be 20261020-r0 or newer, which drops the roots the
+# compromised eMudhra intermediates chain to. The base image ships an older
+# one, and `apk add` does not upgrade installed packages, so upgrade it here.
 RUN apk update && apk add --no-cache \
         git nodejs npm yarn curl wget \
-        ruby ruby-dev build-base strace
+        ruby ruby-dev build-base strace && \
+    apk upgrade --no-cache ca-certificates && \
+    [ "$(apk version -t "$(apk list -I ca-certificates | awk '{print $1}' | sed 's/^ca-certificates-//')" 20261020-r0)" != "<" ]
 
 # Install Go with version control
 RUN if [ "$GO_VERSION" = "system" ]; then \
@@ -84,9 +89,13 @@ RUN npm install socket -g && \
 # Set environment paths
 ENV PATH="/usr/local/go/bin:/usr/lib/go/bin:/root/.cargo/bin:${PATH}"
 ENV GOPATH="/go"
+# Node's bundled CA store still trusts the compromised eMudhra intermediates and
+# no patched Node release exists yet. Use the system store, which ca-certificates
+# above already fixed. Drop this once Node ships its fix.
+ENV NODE_OPTIONS="--use-openssl-ca"
 
-# Install uv
-COPY --from=ghcr.io/astral-sh/uv:0.10.4 /uv /usr/local/bin/uv
+# Install uv (0.13.4+ ships the patched webpki-roots)
+COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv
 
 # Install pyenv
 # pyenv lets us build/install arbitrary Python versions on demand. We install

pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.11.1"
+version = "2.11.2"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [

socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.11.1'
+__version__ = '2.11.2'
 USER_AGENT = f'SocketPythonCLI/{__version__}'