Require certifi>=2026.10.19, upgrade the image's pip, and pin SDK to v3.6.1

.github/workflows/dependency-review.yml

@@ -598,7 +598,8 @@ jobs:
 
       # The eMudhra test hosts serve certificates from the compromised
       # intermediates. Require the specific rejection, not just any failure, so
-      # a DNS or network error cannot pass as "rejected".
+      # a DNS or network error cannot pass as "rejected". pip is checked on its
+      # own because it uses its vendored CA bundle, not the system store.
       - name: Check TLS clients reject the compromised eMudhra intermediates
         run: |
           docker run --rm --entrypoint sh socket-python-cli:dependabot-smoke -c '
@@ -640,6 +641,14 @@ jobs:
               echo "::error::python requests on $host: $result"
               status=1
             fi
+            if python -m pip download --no-deps --no-cache-dir --retries 0 --timeout 30 \
+                --dest /tmp/pip-tls --index-url "https://$host/simple/" certifi 2>&1 \
+                | grep -q CERTIFICATE_VERIFY_FAILED; then
+              echo "pip rejects $host"
+            else
+              echo "::error::pip on $host did not fail certificate verification"
+              status=1
+            fi
           done
           for url in https://api.socket.dev/v0/ https://registry.npmjs.org/ https://pypi.org/simple/; do
             if curl -sS -m 30 -o /dev/null "$url"; then

CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 2.11.3
+
+### Fixed: finish rejecting the compromised eMudhra intermediate CAs
+
+- `socketsecurity` now requires `certifi>=2026.10.19`. Previously only the
+  Docker image's lockfile pinned it, so `pip install socketsecurity` could keep
+  an older CA bundle that trusts the compromised intermediates.
+- The Docker image upgrades `pip` to `26.2.2` or newer. Earlier versions use
+  their own vendored CA bundle, which still trusted them.
+
+### Changed: bump the Socket Python SDK to 3.6.1
+
+- Bumped the pinned Socket Python SDK (`socketdev`) from `3.6.0` to `3.6.1`,
+  which also requires `certifi>=2026.10.19`.
+
 ## 2.11.2
 
 ### Fixed: stop trusting the compromised eMudhra intermediate CAs

Dockerfile

@@ -28,6 +28,12 @@ RUN apk update && apk add --no-cache \
     apk upgrade --no-cache ca-certificates && \
     [ "$(apk version -t "$(apk list -I ca-certificates | awk '{print $1}' | sed 's/^ca-certificates-//')" 20261020-r0)" != "<" ]
 
+# pip uses its own vendored CA bundle, not the system store, and the base image's
+# pip trusts the compromised eMudhra intermediates. 26.2.2 vendors certifi
+# 2026.10.19. Upgrade it against the system store fixed above.
+RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" && \
+    python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))'
+
 # npm, npx and yarn are symlinks in the node image. COPY would dereference them
 # into flat files and break their relative requires, so recreate the links.
 COPY --from=node /usr/local/bin/node /usr/local/bin/node

pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.11.2"
+version = "2.11.3"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,11 +16,15 @@ dependencies = [
     "gitpython==3.2.0",
     "packaging==26.3",
     "python-dotenv==1.2.4",
-    "socketdev==3.6.0",
+    "socketdev==3.6.1",
     "beautifulsoup4==4.15.0",
     "markdown==3.11.1",
     "brotli==1.2.0; platform_python_implementation == 'CPython'",
     "brotlicffi==1.2.0.2; platform_python_implementation != 'CPython'",
+    # requests' CA bundle. A floor rather than an exact pin, so later trust-store
+    # fixes still reach installs; 2026.10.19 drops the roots behind the
+    # compromised eMudhra intermediates.
+    "certifi>=2026.10.19",
 ]
 readme = "README.md"
 description = "Socket Security CLI for CI/CD"

socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.11.2'
+__version__ = '2.11.3'
 USER_AGENT = f'SocketPythonCLI/{__version__}'