socketsecurity 2.11.1__tar.gz → 2.11.2__tar.gz

{socketsecurity-2.11.1 → socketsecurity-2.11.2}/.github/actions/setup-sfw/action.yml

@@ -32,7 +32,7 @@ runs:
         python-version: "3.12"
 
     - if: ${{ inputs.node == 'true' }}
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: "20"
 

{socketsecurity-2.11.1 → socketsecurity-2.11.2}/.github/workflows/dependency-review.yml

@@ -81,7 +81,7 @@ jobs:
             echo "python_deps_changed=$(has_file '^(pyproject\.toml|uv\.lock)$')"
             echo "fixture_npm_changed=$(has_file '^tests/e2e/fixtures/simple-npm/')"
             echo "fixture_pypi_changed=$(has_file '^tests/e2e/fixtures/simple-pypi/')"
-            echo "dockerfile_changed=$(has_file '^Dockerfile$')"
+            echo "dockerfile_changed=$(has_file '^(Dockerfile|scripts/docker-entrypoint\.sh)$')"
             echo "workflow_or_action_changed=$(has_file '^\.github/workflows/|^\.github/actions/|^\.github/dependabot\.yml$')"
           } >> "$GITHUB_OUTPUT"
 
@@ -210,7 +210,7 @@ jobs:
 
       - name: Upload SFW report artifact
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: socket-firewall-free-python-${{ github.event.pull_request.number }}
           path: sfw-artifacts/
@@ -302,7 +302,7 @@ jobs:
 
       - name: Upload SFW report artifact
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: socket-firewall-enterprise-python-${{ github.event.pull_request.number }}
           path: sfw-artifacts/
@@ -362,7 +362,7 @@ jobs:
 
       - name: Upload SFW report artifact
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: socket-firewall-free-npm-${{ github.event.pull_request.number }}
           path: sfw-artifacts/
@@ -424,7 +424,7 @@ jobs:
 
       - name: Upload SFW report artifact
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: socket-firewall-enterprise-npm-${{ github.event.pull_request.number }}
           path: sfw-artifacts/
@@ -487,7 +487,7 @@ jobs:
 
       - name: Upload SFW report artifact
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: socket-firewall-free-pypi-${{ github.event.pull_request.number }}
           path: sfw-artifacts/
@@ -552,7 +552,7 @@ jobs:
 
       - name: Upload SFW report artifact
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: socket-firewall-enterprise-pypi-${{ github.event.pull_request.number }}
           path: sfw-artifacts/
@@ -562,7 +562,18 @@ jobs:
   dockerfile-smoke:
     needs: inspect
     if: needs.inspect.outputs.dockerfile_changed == 'true'
-    runs-on: ubuntu-latest
+    # Build every architecture the release publishes, each on a native runner,
+    # so an arm64-only break shows up here rather than in release.yml.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    name: dockerfile-smoke (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -576,6 +587,71 @@ jobs:
           --build-arg USE_LOCAL_INSTALL=true
           -t socket-python-cli:dependabot-smoke .
 
+      - name: Check the tools in the image
+        run: |
+          docker run --rm --entrypoint sh socket-python-cli:dependabot-smoke -c '
+          set -eu
+          echo "node $(node -v), npm $(npm -v), yarn $(yarn -v)"
+          socket --version
+          socketcli --version
+          '
+
+      # The eMudhra test hosts serve certificates from the compromised
+      # intermediates. Require the specific rejection, not just any failure, so
+      # a DNS or network error cannot pass as "rejected".
+      - name: Check TLS clients reject the compromised eMudhra intermediates
+        run: |
+          docker run --rm --entrypoint sh socket-python-cli:dependabot-smoke -c '
+          set -u
+          status=0
+          for host in dv-g3b-emudhra.we-have-a-problem.com dv-g3b-aaa-emudhra.we-have-a-problem.com; do
+            code=0
+            curl -sS -m 30 -o /dev/null "https://$host/" 2>/dev/null || code=$?
+            if [ "$code" = 60 ]; then
+              echo "curl rejects $host"
+            else
+              echo "::error::curl on $host exited $code, expected 60 (certificate verification failed)"
+              status=1
+            fi
+            result=$(node -e "
+              const req = require(\"https\").get(process.argv[1], { timeout: 30000 }, (res) => {
+                console.log(\"ACCEPTED\"); process.exit(0);
+              });
+              req.on(\"timeout\", () => { console.log(\"TIMEOUT\"); process.exit(0); });
+              req.on(\"error\", (e) => { console.log(e.code || e.message); process.exit(0); });
+            " "https://$host/")
+            case "$result" in
+              CERT_REVOKED|UNABLE_TO_GET_ISSUER_CERT_LOCALLY|UNABLE_TO_VERIFY_LEAF_SIGNATURE) echo "node rejects $host ($result)" ;;
+              *) echo "::error::node on $host: $result"; status=1 ;;
+            esac
+            result=$(python -c "
+          import sys, requests
+          try:
+              requests.get(sys.argv[1], timeout=30)
+              print(\"ACCEPTED\")
+          except requests.exceptions.SSLError:
+              print(\"SSLError\")
+          except Exception as e:
+              print(type(e).__name__)
+          " "https://$host/")
+            if [ "$result" = SSLError ]; then
+              echo "python rejects $host"
+            else
+              echo "::error::python requests on $host: $result"
+              status=1
+            fi
+          done
+          for url in https://api.socket.dev/v0/ https://registry.npmjs.org/ https://pypi.org/simple/; do
+            if curl -sS -m 30 -o /dev/null "$url"; then
+              echo "curl connects to $url"
+            else
+              echo "::error::curl cannot connect to $url"
+              status=1
+            fi
+          done
+          exit $status
+          '
+
   workflow-notice:
     needs: inspect
     if: needs.inspect.outputs.workflow_or_action_changed == 'true'

{socketsecurity-2.11.1 → socketsecurity-2.11.2}/.github/workflows/e2e-test.yml

@@ -84,10 +84,10 @@ jobs:
         with:
           python-version: '3.12'
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         if: matrix.setup-node == 'true'
         with:
-          node-version: '20'
+          node-version: '22'
 
       - name: Install CLI from local repo
         run: |
@@ -138,7 +138,7 @@ jobs:
 
       - name: Upload diagnostics on failure
         if: failure() || steps.run-cli.outputs.diagnostics == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: e2e-${{ matrix.name }}-diagnostics-attempt${{ github.run_attempt }}
           path: |

{socketsecurity-2.11.1 → socketsecurity-2.11.2}/.github/workflows/package-check.yml

@@ -58,7 +58,7 @@ jobs:
           PY
 
       - name: Upload distributions
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: socketsecurity-${{ github.sha }}
           path: dist/*

{socketsecurity-2.11.1 → socketsecurity-2.11.2}/.github/workflows/pr-preview.yml

@@ -153,7 +153,7 @@ jobs:
           PY
 
       - name: Upload preview distributions
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: socketsecurity-preview-${{ github.run_id }}-${{ github.run_attempt }}
           path: dist/*
@@ -173,7 +173,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Download preview distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: socketsecurity-preview-${{ github.run_id }}-${{ github.run_attempt }}
           path: dist
@@ -246,7 +246,7 @@ jobs:
           persist-credentials: false
 
       - name: Download preview distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: socketsecurity-preview-${{ github.run_id }}-${{ github.run_attempt }}
           path: dist

{socketsecurity-2.11.1 → socketsecurity-2.11.2}/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 2.11.2
+
+### Fixed: stop trusting the compromised eMudhra intermediate CAs
+
+- The CLI and every tool in the Docker image now reject certificates issued
+  from the compromised eMudhra intermediate CAs.
+- Bumped `certifi` to `2026.10.19` and the image's bundled `uv` to `0.13.4`.
+- The image now takes Node.js from the official `node:24-alpine` image (`24.22.1`)
+  instead of Alpine's `nodejs` package, which hasn't shipped Node's fix.
+
+### Changed: bump pinned Coana CLI to 15.12.11
+
+- Bumped the pinned reachability engine (the Coana CLI) from `15.12.10` to
+  `15.12.11`. See the
+  [reachability analysis changelog](https://docs.socket.dev/docs/reachability-analysis-changelog)
+  for engine changes.
+- Coana CLI `15.12.11` requires Node.js 22.13 or later (previously 20). On an older Node,
+  `--reach` fails with exit code 3 (with `--disable-blocking`, the scan continues without
+  reachability results). The Docker image already ships a newer Node, but if you run the CLI
+  directly (for example in CI), upgrade Node before upgrading the Socket CLI.
+
 ## 2.11.1
 
 ### Changed: bump pinned Coana CLI to 15.12.10

{socketsecurity-2.11.1 → socketsecurity-2.11.2}/Dockerfile

@@ -1,3 +1,8 @@
+# Node.js from the official Alpine image instead of Alpine's nodejs package, which
+# lags Node's security releases. Match the major version to what reachability needs
+# and the Alpine release to the python:3-alpine base below.
+FROM node:24-alpine3.24 AS node
+
 FROM python:3-alpine
 LABEL org.opencontainers.image.authors="socket.dev"
 
@@ -14,9 +19,27 @@ ARG PIP_EXTRA_INDEX_URL=https://pypi.org/simple
 ARG USE_LOCAL_INSTALL=false
 
 # Install base packages first
+# ca-certificates must be 20261020-r0 or newer, which drops the roots the
+# compromised eMudhra intermediates chain to. The base image ships an older
+# one, and `apk add` does not upgrade installed packages, so upgrade it here.
 RUN apk update && apk add --no-cache \
-        git nodejs npm yarn curl wget \
-        ruby ruby-dev build-base strace
+        git curl wget \
+        ruby ruby-dev build-base strace && \
+    apk upgrade --no-cache ca-certificates && \
+    [ "$(apk version -t "$(apk list -I ca-certificates | awk '{print $1}' | sed 's/^ca-certificates-//')" 20261020-r0)" != "<" ]
+
+# npm, npx and yarn are symlinks in the node image. COPY would dereference them
+# into flat files and break their relative requires, so recreate the links.
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+COPY --from=node /opt /opt
+# Node rejects the compromised eMudhra intermediates from 24.22.1.
+RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && \
+    ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx && \
+    ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack && \
+    ln -s /opt/yarn-v*/bin/yarn /usr/local/bin/yarn && \
+    ln -s /opt/yarn-v*/bin/yarnpkg /usr/local/bin/yarnpkg && \
+    node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>24||(a===24&&(b>22||(b===22&&c>=1)))?0:1)'
 
 # Install Go with version control
 RUN if [ "$GO_VERSION" = "system" ]; then \
@@ -85,8 +108,8 @@ RUN npm install socket -g && \
 ENV PATH="/usr/local/go/bin:/usr/lib/go/bin:/root/.cargo/bin:${PATH}"
 ENV GOPATH="/go"
 
-# Install uv
-COPY --from=ghcr.io/astral-sh/uv:0.10.4 /uv /usr/local/bin/uv
+# Install uv (0.13.4+ ships the patched webpki-roots)
+COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv
 
 # Install pyenv
 # pyenv lets us build/install arbitrary Python versions on demand. We install

{socketsecurity-2.11.1 → socketsecurity-2.11.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: socketsecurity
-Version: 2.11.1
+Version: 2.11.2
 Summary: Socket Security CLI for CI/CD
 Project-URL: Homepage, https://socket.dev
 Author-email: Douglas Coburn <douglas@socket.dev>
@@ -36,24 +36,24 @@ Requires-Python: >=3.11
 Requires-Dist: beautifulsoup4==4.15.0
 Requires-Dist: brotli==1.2.0; platform_python_implementation == 'CPython'
 Requires-Dist: brotlicffi==1.2.0.2; platform_python_implementation != 'CPython'
-Requires-Dist: gitpython==3.1.62
-Requires-Dist: markdown==3.10.3
+Requires-Dist: gitpython==3.2.0
+Requires-Dist: markdown==3.11.1
 Requires-Dist: mdutils==1.8.1
 Requires-Dist: packaging==26.3
 Requires-Dist: prettytable==3.18.0
-Requires-Dist: python-dotenv==1.2.3
+Requires-Dist: python-dotenv==1.2.4
 Requires-Dist: requests==2.34.2
 Requires-Dist: socketdev==3.6.0
 Provides-Extra: dev
 Requires-Dist: hatch==1.18.1; extra == 'dev'
-Requires-Dist: pre-commit==4.6.2; extra == 'dev'
-Requires-Dist: ruff==0.16.9; extra == 'dev'
+Requires-Dist: pre-commit==4.7.0; extra == 'dev'
+Requires-Dist: ruff==0.17.0; extra == 'dev'
 Requires-Dist: twine==7.0.0; extra == 'dev'
-Requires-Dist: uv==0.12.18; extra == 'dev'
+Requires-Dist: uv==0.13.4; extra == 'dev'
 Provides-Extra: test
 Requires-Dist: pytest-asyncio==1.4.0; extra == 'test'
 Requires-Dist: pytest-cov==7.1.0; extra == 'test'
-Requires-Dist: pytest-mock==3.15.1; extra == 'test'
+Requires-Dist: pytest-mock==3.16.0; extra == 'test'
 Requires-Dist: pytest-watch==4.2.0; extra == 'test'
 Requires-Dist: pytest==9.1.1; extra == 'test'
 Description-Content-Type: text/markdown

{socketsecurity-2.11.1 → socketsecurity-2.11.2}/docs/cli-reference.md

@@ -338,7 +338,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.12.10 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.12.11 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
@@ -359,7 +359,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 **Reachability Analysis Requirements:**
 
 The Python CLI verifies the following **up front** (before invoking the analysis engine) and exits with code **3** if any are unmet:
-- `node` - Required to run the analysis engine (the Coana CLI). The engine needs Node.js 20 or later.
+- `node` - Required to run the analysis engine (the Coana CLI). The engine needs Node.js 22.13 or later.
 - `uv` - Required by the analysis engine
 - An **Enterprise** Socket organization plan (any `enterprise*` plan, including Enterprise trials)
 

{socketsecurity-2.11.1 → socketsecurity-2.11.2}/pyproject.toml

@@ -6,19 +6,19 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.11.1"
+version = "2.11.2"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
     "requests==2.34.2",
     "mdutils==1.8.1",
     "prettytable==3.18.0",
-    "gitpython==3.1.62",
+    "gitpython==3.2.0",
     "packaging==26.3",
-    "python-dotenv==1.2.3",
+    "python-dotenv==1.2.4",
     "socketdev==3.6.0",
     "beautifulsoup4==4.15.0",
-    "markdown==3.10.3",
+    "markdown==3.11.1",
     "brotli==1.2.0; platform_python_implementation == 'CPython'",
     "brotlicffi==1.2.0.2; platform_python_implementation != 'CPython'",
 ]
@@ -42,15 +42,15 @@ classifiers = [
 test = [
     "pytest==9.1.1",
     "pytest-cov==7.1.0",
-    "pytest-mock==3.15.1",
+    "pytest-mock==3.16.0",
     "pytest-asyncio==1.4.0",
     "pytest-watch==4.2.0"
 ]
 dev = [
-    "ruff==0.16.9",
+    "ruff==0.17.0",
     "twine==7.0.0", # for building
-    "uv==0.12.18",  # for dependency management
-    "pre-commit==4.6.2",
+    "uv==0.13.4",  # for dependency management
+    "pre-commit==4.7.0",
     "hatch==1.18.1"
 ]
 

{socketsecurity-2.11.1 → socketsecurity-2.11.2}/socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.11.1'
+__version__ = '2.11.2'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

{socketsecurity-2.11.1 → socketsecurity-2.11.2}/socketsecurity/core/tools/reachability.py

@@ -22,7 +22,7 @@ log = logging.getLogger(__name__)
 # Pinned Coana CLI version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.12.10"
+DEFAULT_COANA_CLI_VERSION: Final = "15.12.11"
 
 # Vendored from coana-package-manager, where it is generated; the only code that may read or
 # write the cache Coana shares with the Socket CLIs. See "Launching Coana" in that repo's