From a10784de76787986569f43caaf3d9076570c7fe9 Mon Sep 17 00:00:00 2001 From: Andrew Hosgood Date: Wed, 21 Oct 2026 12:22:55 +0100 Subject: [PATCH 1/5] Update dependencies for Ruff, Prettier, Node, and pip --- CHANGELOG.md | 14 +++++++++++++- docker/tna-python-dev/Dockerfile | 4 ++-- docker/tna-python/Dockerfile | 4 ++-- 3 files changed, 17 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6f7ca6e..f4aa139 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -## [Unreleased](https://github.com/nationalarchives/docker/compare/v1.23.0...HEAD) +## [Unreleased](https://github.com/nationalarchives/docker/compare/v1.24.0...HEAD) ### Added ### Changed @@ -14,6 +14,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed ### Security +## [1.24.0](https://github.com/nationalarchives/docker/compare/v1.23.0...v1.24.0) - 2026-10-21 + +### Changed + +- Updated Ruff to [0.17.0](https://github.com/astral-sh/ruff/releases/tag/0.17.0) +- Updated Prettier to [3.9.10](https://github.com/prettier/prettier/releases/tag/3.9.10) +- Updated Node to [v24.22.1](https://github.com/nodejs/node/releases/tag/v24.22.1) + +### Security + +- Update pip tp [26.2.2](https://github.com/pypa/pip/blob/main/NEWS.rst#2622-2026-10-20) following [eMudhra Intermediate CA Compromise](https://emudhra.we-have-a-problem.com/) + ## [1.23.0](https://github.com/nationalarchives/docker/compare/v1.22.0...v1.23.0) - 2026-10-14 ### Changed diff --git a/docker/tna-python-dev/Dockerfile b/docker/tna-python-dev/Dockerfile index 646c181..1092643 100644 --- a/docker/tna-python-dev/Dockerfile +++ b/docker/tna-python-dev/Dockerfile @@ -48,10 +48,10 @@ RUN apt-get update; \ # Set the versions for various tools that we # want to install to help with development # ========================================== -ENV RUFF_VERSION=0.16.10 \ +ENV RUFF_VERSION=0.17.0 \ DJLINT_VERSION=1.46.4 \ DJANGO_DEBUG_TOOLBAR_VERSION=8.0.0 \ - PRETTIER_VERSION=3.9.9 \ + PRETTIER_VERSION=3.9.10 \ TNA_RUFF_CONFIG_VERSION=0.2.0 \ TNA_ESLINT_CONFIG_VERSION=0.1.9 \ TNA_STYLELINT_CONFIG_VERSION=0.1.5 diff --git a/docker/tna-python/Dockerfile b/docker/tna-python/Dockerfile index a01f666..b47dd72 100644 --- a/docker/tna-python/Dockerfile +++ b/docker/tna-python/Dockerfile @@ -72,8 +72,8 @@ ENV PIP_NO_CACHE_DIR=true \ # environment variable at build-time" # > docs.docker.com/build/building/variables # ========================================== -ENV NODEJS_VERSION=24.21.0 \ - PIP_VERSION=26.2.1 \ +ENV NODEJS_VERSION=24.22.1 \ + PIP_VERSION=26.2.2 \ POETRY_VERSION=2.5.1 \ NVM_VERSION=0.40.8 \ WSGI_GUNICORN_VERSION=26.2.0 \ From 28bc51898c6975fe807f43fd017709e80d682e1f Mon Sep 17 00:00:00 2001 From: Andrew Hosgood Date: Wed, 21 Oct 2026 12:28:00 +0100 Subject: [PATCH 2/5] Update pip installation command to include --uploaded-prior-to option --- docker/tna-python/Dockerfile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docker/tna-python/Dockerfile b/docker/tna-python/Dockerfile index b47dd72..92f731b 100644 --- a/docker/tna-python/Dockerfile +++ b/docker/tna-python/Dockerfile @@ -159,9 +159,11 @@ RUN set -eux; \ rm -rfv /var/lib/apt/lists/* # ========================================== -# Upgrade pip to a later version +# Upgrade pip to a later version - we ignore +# the cooldown period here in case an urgent +# security fix is needed # ========================================== -RUN pip install --no-cache-dir --quiet --upgrade --root-user-action=ignore pip=="$PIP_VERSION" +RUN pip install --no-cache-dir --quiet --upgrade --root-user-action=ignore --uploaded-prior-to=P0D pip=="$PIP_VERSION" # ========================================== # Create an "/app" directory in the root dir From e3b01b54ac4369d791e4fc03ad54040d9b888d85 Mon Sep 17 00:00:00 2001 From: Andrew Hosgood Date: Wed, 21 Oct 2026 12:44:20 +0100 Subject: [PATCH 3/5] Update certifi to address security concerns --- CHANGELOG.md | 2 +- docker/tna-python/Dockerfile | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f4aa139..90ab980 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -24,7 +24,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Security -- Update pip tp [26.2.2](https://github.com/pypa/pip/blob/main/NEWS.rst#2622-2026-10-20) following [eMudhra Intermediate CA Compromise](https://emudhra.we-have-a-problem.com/) +- Update pip tp [26.2.2](https://github.com/pypa/pip/blob/main/NEWS.rst#2622-2026-10-20) and certify to [2026.10.19](https://pypi.org/project/certifi/2026.10.19/) following [eMudhra Intermediate CA Compromise](https://emudhra.we-have-a-problem.com/) ## [1.23.0](https://github.com/nationalarchives/docker/compare/v1.22.0...v1.23.0) - 2026-10-14 diff --git a/docker/tna-python/Dockerfile b/docker/tna-python/Dockerfile index 92f731b..72f2ca2 100644 --- a/docker/tna-python/Dockerfile +++ b/docker/tna-python/Dockerfile @@ -153,7 +153,7 @@ RUN set -eux; \ export DEBIAN_FRONTEND=noninteractive; \ apt-get update; \ apt-get -y upgrade; \ - apt-get install -y --no-install-recommends curl=8.14.1-2+deb13u7 perl=5.40.1-6+deb13u1; \ + apt-get install -y --no-install-recommends curl=8.14.1-2+deb13u7 perl=5.40.1-6+deb13u1 ca-certificates=20250419+deb13u1; \ apt-get clean; \ apt-get autoremove -y --purge; \ rm -rfv /var/lib/apt/lists/* @@ -163,7 +163,10 @@ RUN set -eux; \ # the cooldown period here in case an urgent # security fix is needed # ========================================== -RUN pip install --no-cache-dir --quiet --upgrade --root-user-action=ignore --uploaded-prior-to=P0D pip=="$PIP_VERSION" +# TEMPORARY: Update certifi until it gets an +# update upstream +# ========================================== +RUN pip install --no-cache-dir --quiet --upgrade --root-user-action=ignore --uploaded-prior-to=P0D pip=="$PIP_VERSION" certifi==2026.10.19 # ========================================== # Create an "/app" directory in the root dir From ca681e9ee0b4d1d044769fd7f35152588cab01b1 Mon Sep 17 00:00:00 2001 From: Andrew Hosgood Date: Wed, 21 Oct 2026 12:46:46 +0100 Subject: [PATCH 4/5] Update CHANGELOG.md --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 90ab980..c0c98c9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -24,7 +24,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Security -- Update pip tp [26.2.2](https://github.com/pypa/pip/blob/main/NEWS.rst#2622-2026-10-20) and certify to [2026.10.19](https://pypi.org/project/certifi/2026.10.19/) following [eMudhra Intermediate CA Compromise](https://emudhra.we-have-a-problem.com/) +- Update pip to [26.2.2](https://github.com/pypa/pip/blob/main/NEWS.rst#2622-2026-10-20), certify to [2026.10.19](https://pypi.org/project/certifi/2026.10.19/) and `ca-certificates` to [20250419+deb13u1](https://lists.debian.org/debian-security-announce/2026/msg00487.html?pow_referer=) following [eMudhra Intermediate CA Compromise](https://emudhra.we-have-a-problem.com/) ## [1.23.0](https://github.com/nationalarchives/docker/compare/v1.22.0...v1.23.0) - 2026-10-14 From 2d1d39d9faffdb478d8a4bc677328e7bf4e13a02 Mon Sep 17 00:00:00 2001 From: Andrew Hosgood Date: Wed, 21 Oct 2026 13:08:50 +0100 Subject: [PATCH 5/5] Update certifi version in Dockerfile to use variable for consistency --- docker/tna-python/Dockerfile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docker/tna-python/Dockerfile b/docker/tna-python/Dockerfile index 72f2ca2..49bdb02 100644 --- a/docker/tna-python/Dockerfile +++ b/docker/tna-python/Dockerfile @@ -74,6 +74,7 @@ ENV PIP_NO_CACHE_DIR=true \ # ========================================== ENV NODEJS_VERSION=24.22.1 \ PIP_VERSION=26.2.2 \ + CERTIFI_VERSION=2026.10.19 \ POETRY_VERSION=2.5.1 \ NVM_VERSION=0.40.8 \ WSGI_GUNICORN_VERSION=26.2.0 \ @@ -166,7 +167,7 @@ RUN set -eux; \ # TEMPORARY: Update certifi until it gets an # update upstream # ========================================== -RUN pip install --no-cache-dir --quiet --upgrade --root-user-action=ignore --uploaded-prior-to=P0D pip=="$PIP_VERSION" certifi==2026.10.19 +RUN pip install --no-cache-dir --quiet --upgrade --root-user-action=ignore --uploaded-prior-to=P0D pip=="$PIP_VERSION" certifi=="$CERTIFI_VERSION" # ========================================== # Create an "/app" directory in the root dir @@ -184,6 +185,7 @@ RUN mkdir -p /app; \ # ========================================== RUN set -eux; \ curl -sSL "https://install.python-poetry.org" | python -; \ + "$POETRY_HOME/venv/bin/python" -m pip install --no-cache-dir --quiet --upgrade --uploaded-prior-to=P0D certifi=="$CERTIFI_VERSION"; \ curl -o- "https://raw.githubusercontent.com/nvm-sh/nvm/v$NVM_VERSION/install.sh" | bash; \ chown app:app -R "$POETRY_HOME" "$NVM_DIR"