[lelia]

Draft. Do not merge yet. Staged release for the eMudhra intermediate CA fix. Stacked on #128; retarget to main once #128 merges.

What's in it

• Everything in fix(docker): stop trusting the compromised eMudhra intermediate CAs #128: ca-certificates >= 20250419+deb13u1 in both images, certifi 2026.10.19, a certifi floor on heavy's system interpreter, and a Node 22.23.4 floor in both images.
• Socket Python CLI 2.9.0 -> 2.11.3 in the heavy and app-tests images, and Socket Python SDK 3.6.0 -> 3.6.1 in uv.lock. Both require certifi>=2026.10.19; 2.11.3 also upgrades its own image's pip (Stop trusting the compromised eMudhra intermediate CAs socket-python-cli#415, #418). Relocked with uv 0.12.1, which keeps lock format revision 3 like main.
• Trivy 0.73.0 -> 0.76.1, upstream's eMudhra release, built on Go 1.27.3 (SocketDev/trivy-dist#25). The image tag, TRIVY_VERSION, tests and docs are updated; the digest is a placeholder.
• scripts/prep_release.py --version 3.4.1: version files, uv.lock, action.yml (socket-basics:3.4.1), README and docs. check_release_docs.py --check and sync_release_version.py --check pass.

Before this ships

• fix(docker): stop trusting the compromised eMudhra intermediate CAs #128 merged, then retarget this PR to main.
• socketsecurity 2.11.3 published and pinned (Stop trusting the compromised eMudhra intermediate CAs socket-python-cli#415, #418).
• Socket Python SDK 3.6.1 published and locked (Release v3.6.1: patched certifi, uv and virtualenv; require certifi>=2026.10.19 socket-sdk-python#120).
• Trivy digest: once trivy-dist publishes 0.76.1 (SocketDev/trivy-dist#25), replace the placeholder sha256:0000… digest in Dockerfile, Dockerfile.heavy and app_tests/Dockerfile (marked TODO(release 3.4.1)). Image builds fail until then. Run regression tests on the final images, since this is three upstream minor versions; trivy-dist#25 has the CLI and report-format review. check_core_tools.py keeps its -socket.N support for future toolchain rebuilds.
• TruffleHog: no release built on a fixed Go yet (3.99.3 is go1.27.2). As with Trivy, runtime trust is fixed by the system store; this is about scanner findings.
• Node: 22.23.4 has the fix. fix(docker): stop trusting the compromised eMudhra intermediate CAs #128 now fails the build below it and no longer sets NODE_OPTIONS.
• Tool pin scope: limited to bumps the compromise requires. Python CLI 2.11.3, SDK 3.6.1 and Trivy 0.76.1 are in; TruffleHog waits for a build on a fixed Go (see above). uv is build-time only here and uv sync --frozen verifies hashes; OpenGrep and the Socket npm CLI carry no CA store of their own (the npm CLI runs on the image's Node). The broader refresh stays in chore(deps): refresh bundled tool pins and make them Dependabot-readable #118.
• CVE-2026-111943: the changelog cites this ID from the customer report. Confirm it's public and correct before publishing.
• Re-run scripts/prep_release.py --version 3.4.1 --date <ship date> to restamp the CHANGELOG date (currently 2026-10-20).
• Merge last, then tag the merge commit v3.4.1 to trigger publish.

Verification for the final build

On the published 3.4.1 and 3.4.1-heavy images, every client should fail certificate verification against both dv-g3b-emudhra.we-have-a-problem.com and dv-g3b-aaa-emudhra.we-have-a-problem.com:

docker run --rm --entrypoint sh ghcr.io/socketdev/socket-basics:3.4.1 -c 'H=dv-g3b-emudhra.we-have-a-problem.com; curl -sS -o /dev/null -w "curl %{http_code}\n" https://$H/; /socket-basics/.venv/bin/python -c "import requests; print(\"python\", requests.get(\"https://$H/\").status_code)"; node -e "fetch(\"https://$H/\").then(r=>console.log(\"node\",r.status),e=>console.log(\"node rejects\"))"; trivy image --download-db-only --db-repository $H/trivy-db 2>&1 | tail -1'

Local builds of #128's branch already pass this for the standard and heavy images (results in the #128 thread).

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​socketdev@​3.6.0 ⏵ 3.6.1

View full report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​socketdev@​3.6.0 ⏵ 3.6.1

View full report