GeezerVison

Updates the Docker image so its TLS clients stop trusting the eMudhra intermediate CAs whose keys were disclosed on 2026-10-20 (details), and makes CI check that on both architectures. Ships in 2.11.2 with the Coana bump from #417. Companion to SocketDev/socket-basics#128.

Root Cause

The image's trust stores predate the distrust:

• Alpine ca-certificates from the base image (curl, git, Go, Java). apk add doesn't upgrade packages the base image already has.
• Node, used by Coana and the Socket npm CLI. Node fixed this in 22.23.4 / 24.22.1, but the image installed Alpine's nodejs package, which is still 24.18.1 on every Alpine branch.
• uv 0.10.4's bundled roots.
• certifi 2025.11.12 (Python requests). Already fixed on main by chore(deps): bump certifi from 2025.11.12 to 2026.10.19 #414.

Fix

• Dockerfile: upgrade ca-certificates and fail the build below 20261020-r0.
• Dockerfile: copy Node, npm, corepack and yarn from node:24-alpine3.24 instead of apk add nodejs npm yarn, and fail the build below Node 24.22.1. Same major version as before, and Dependabot now tracks it. An earlier revision of this PR set NODE_OPTIONS=--use-openssl-ca instead; that's gone.
• Dockerfile: uv 0.13.4.
• dependency-review.yml: dockerfile-smoke builds on native amd64 and arm64 runners (it was amd64 only, with no checks). It now checks that the bundled tools run, that curl, Node and Python requests reject the eMudhra test hosts with a certificate error, and that api.socket.dev, npm and PyPI still connect. It also runs when scripts/docker-entrypoint.sh changes.
• CHANGELOG.md: adds this fix to the unreleased 2.11.2 entry.

Alpine's go package is still 1.26.9, so scanners will keep flagging it until Alpine updates. Its TLS uses the fixed system store.

Testing

socketdev/cli:pr-415 is socketdev/cli:latest plus this PR's wheel, so it doesn't include these Dockerfile changes. Instead:

• dockerfile-smoke builds the real Dockerfile on both architectures and runs the checks above. Against socketdev/cli:latest (2.11.1), the TLS check fails, as it should.
• Locally, on both architectures: Node 24.22.1, npm 11.19.1, yarn 1.22.22; no Alpine nodejs/npm/yarn. A --reach scan of a small npm fixture (lodash 4.17.20 calling _.template) runs Coana 15.12.11, finds 5 vulnerabilities (2 reachable) and uploads the full scan.
• pytest (580 passed). The TestPyPI preview socketsecurity==2.11.2.dev3966658374001 installs in a clean venv.

Public Changelog

The CLI and every tool in the socketdev/cli Docker image now reject certificates issued from the compromised eMudhra intermediate CAs.