Require certifi>=2026.10.19 and upgrade the image's pip

certifi only came in through requests, so pip installs of socketsecurity
could keep a CA bundle that trusts the compromised eMudhra intermediates;
only the Docker image's lockfile pinned it. Add a floor to the package's
dependencies.

The image's pip (26.2.1) uses its own vendored CA bundle and still trusted
them. Upgrade it to 26.2.2 or newer against the fixed system store, and
have dockerfile-smoke require pip to reject the test hosts too.

Author: lelia

.github/workflows/dependency-review.yml

@@ -598,7 +598,8 @@ jobs:
 
       # The eMudhra test hosts serve certificates from the compromised
       # intermediates. Require the specific rejection, not just any failure, so
-      # a DNS or network error cannot pass as "rejected".
+      # a DNS or network error cannot pass as "rejected". pip is checked on its
+      # own because it uses its vendored CA bundle, not the system store.
       - name: Check TLS clients reject the compromised eMudhra intermediates
         run: |
           docker run --rm --entrypoint sh socket-python-cli:dependabot-smoke -c '
@@ -640,6 +641,14 @@ jobs:
               echo "::error::python requests on $host: $result"
               status=1
             fi
+            if python -m pip download --no-deps --no-cache-dir --retries 0 --timeout 30 \
+                --dest /tmp/pip-tls --index-url "https://$host/simple/" certifi 2>&1 \
+                | grep -q CERTIFICATE_VERIFY_FAILED; then
+              echo "pip rejects $host"
+            else
+              echo "::error::pip on $host did not fail certificate verification"
+              status=1
+            fi
           done
           for url in https://api.socket.dev/v0/ https://registry.npmjs.org/ https://pypi.org/simple/; do
             if curl -sS -m 30 -o /dev/null "$url"; then

CHANGELOG.md

@@ -2,9 +2,18 @@
 
 ## 2.11.3
 
+### Fixed: finish rejecting the compromised eMudhra intermediate CAs
+
+- `socketsecurity` now requires `certifi>=2026.10.19`. Previously only the
+  Docker image's lockfile pinned it, so `pip install socketsecurity` could keep
+  an older CA bundle that trusts the compromised intermediates.
+- The Docker image upgrades `pip` to `26.2.2` or newer. Earlier versions use
+  their own vendored CA bundle, which still trusted them.
+
 ### Changed: bump the Socket Python SDK to 3.6.1
 
-- Bumped the pinned Socket Python SDK (`socketdev`) from `3.6.0` to `3.6.1`.
+- Bumped the pinned Socket Python SDK (`socketdev`) from `3.6.0` to `3.6.1`,
+  which also requires `certifi>=2026.10.19`.
 
 ## 2.11.2
 

Dockerfile

@@ -28,6 +28,12 @@ RUN apk update && apk add --no-cache \
     apk upgrade --no-cache ca-certificates && \
     [ "$(apk version -t "$(apk list -I ca-certificates | awk '{print $1}' | sed 's/^ca-certificates-//')" 20261020-r0)" != "<" ]
 
+# pip uses its own vendored CA bundle, not the system store, and the base image's
+# pip trusts the compromised eMudhra intermediates. 26.2.2 vendors certifi
+# 2026.10.19. Upgrade it against the system store fixed above.
+RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" && \
+    python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))'
+
 # npm, npx and yarn are symlinks in the node image. COPY would dereference them
 # into flat files and break their relative requires, so recreate the links.
 COPY --from=node /usr/local/bin/node /usr/local/bin/node

pyproject.toml

@@ -21,6 +21,10 @@ dependencies = [
     "markdown==3.11.1",
     "brotli==1.2.0; platform_python_implementation == 'CPython'",
     "brotlicffi==1.2.0.2; platform_python_implementation != 'CPython'",
+    # requests' CA bundle. A floor rather than an exact pin, so later trust-store
+    # fixes still reach installs; 2026.10.19 drops the roots behind the
+    # compromised eMudhra intermediates.
+    "certifi>=2026.10.19",
 ]
 readme = "README.md"
 description = "Socket Security CLI for CI/CD"