GeezerVison

Follow-up to #415 for the eMudhra intermediate CA compromise: closes the two remaining gaps, and pins Socket Python SDK 3.6.1 (SocketDev/socket-sdk-python#120), which carries the same certifi fix. Released as 2.11.3.

Root Cause

• certifi wasn't a dependency of the package. requests brings it in, so only uv.lock pinned it, and uv.lock isn't published. The Docker image installs from the lock, but pip install socketsecurity resolves certifi on its own and can keep a bundle that trusts the compromised intermediates. This includes existing environments and tools that bundle the CLI.
• The image's pip trusts them. pip uses its own vendored CA bundle, not the system store. socketdev/cli:2.11.2 ships pip 26.2.1 (vendored certifi 2026.06.17), which completes a request to dv-g3b-emudhra.we-have-a-problem.com.

Fix

• pyproject.toml: require certifi>=2026.10.19. It's a floor, not an exact pin like the other dependencies, so later trust-store fixes still reach installs.
• Dockerfile: upgrade pip to 26.2.2 or newer (vendors certifi 2026.10.19) against the fixed system store, and fail the build on anything older.
• dependency-review.yml: dockerfile-smoke also requires pip to reject the test hosts.
• pyproject.toml, uv.lock: socketdev==3.6.1, which requires certifi>=2026.10.19 too. Version 2.11.3 and changelog.

Testing

• The built wheel lists Requires-Dist: certifi>=2026.10.19. pytest (580 passed) against the 3.6.1 lock.
• Built python:3-alpine with this PR's CA store and pip steps: pip 26.2.2 rejects both test hosts with CERTIFICATE_VERIFY_FAILED and still reaches PyPI. The same check fails against socketdev/cli:2.11.2.
• dockerfile-smoke passes on amd64 and arm64: the build upgrades pip from 26.2.1, and curl, Node, Python requests and pip all reject both test hosts, while api.socket.dev, npm and PyPI still connect.

Public Changelog

socketsecurity now requires certifi>=2026.10.19, and the socketdev/cli image's pip no longer trusts the compromised eMudhra intermediate CAs.