Update dependencies for Ruff, Prettier, Node, and pip

CHANGELOG.md

@@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased](https://github.com/nationalarchives/docker/compare/v1.23.0...HEAD)
+## [Unreleased](https://github.com/nationalarchives/docker/compare/v1.24.0...HEAD)
 
 ### Added
 ### Changed
@@ -14,6 +14,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 ### Security
 
+## [1.24.0](https://github.com/nationalarchives/docker/compare/v1.23.0...v1.24.0) - 2026-10-21
+
+### Changed
+
+- Updated Ruff to [0.17.0](https://github.com/astral-sh/ruff/releases/tag/0.17.0)
+- Updated Prettier to [3.9.10](https://github.com/prettier/prettier/releases/tag/3.9.10)
+- Updated Node to [v24.22.1](https://github.com/nodejs/node/releases/tag/v24.22.1)
+
+### Security
+
+- Update pip to [26.2.2](https://github.com/pypa/pip/blob/main/NEWS.rst#2622-2026-10-20), certify to [2026.10.19](https://pypi.org/project/certifi/2026.10.19/) and `ca-certificates` to [20250419+deb13u1](https://lists.debian.org/debian-security-announce/2026/msg00487.html?pow_referer=) following [eMudhra Intermediate CA Compromise](https://emudhra.we-have-a-problem.com/)
+
 ## [1.23.0](https://github.com/nationalarchives/docker/compare/v1.22.0...v1.23.0) - 2026-10-14
 
 ### Changed

docker/tna-python-dev/Dockerfile

@@ -48,10 +48,10 @@ RUN apt-get update; \
 # Set the versions for various tools that we
 # want to install to help with development
 # ==========================================
-ENV RUFF_VERSION=0.16.10 \
+ENV RUFF_VERSION=0.17.0 \
     DJLINT_VERSION=1.46.4 \
     DJANGO_DEBUG_TOOLBAR_VERSION=8.0.0 \
-    PRETTIER_VERSION=3.9.9 \
+    PRETTIER_VERSION=3.9.10 \
     TNA_RUFF_CONFIG_VERSION=0.2.0 \
     TNA_ESLINT_CONFIG_VERSION=0.1.9 \
     TNA_STYLELINT_CONFIG_VERSION=0.1.5

docker/tna-python/Dockerfile

@@ -72,8 +72,9 @@ ENV PIP_NO_CACHE_DIR=true \
 #    environment variable at build-time"
 # > docs.docker.com/build/building/variables
 # ==========================================
-ENV NODEJS_VERSION=24.21.0 \
-    PIP_VERSION=26.2.1 \
+ENV NODEJS_VERSION=24.22.1 \
+    PIP_VERSION=26.2.2 \
+    CERTIFI_VERSION=2026.10.19 \
     POETRY_VERSION=2.5.1 \
     NVM_VERSION=0.40.8 \
     WSGI_GUNICORN_VERSION=26.2.0 \
@@ -153,15 +154,20 @@ RUN set -eux; \
     export DEBIAN_FRONTEND=noninteractive; \
     apt-get update; \
     apt-get -y upgrade; \
-    apt-get install -y --no-install-recommends curl=8.14.1-2+deb13u7 perl=5.40.1-6+deb13u1; \
+    apt-get install -y --no-install-recommends curl=8.14.1-2+deb13u7 perl=5.40.1-6+deb13u1 ca-certificates=20250419+deb13u1; \
     apt-get clean; \
     apt-get autoremove -y --purge; \
 	rm -rfv /var/lib/apt/lists/*
 
 # ==========================================
-# Upgrade pip to a later version
+# Upgrade pip to a later version - we ignore
+# the cooldown period here in case an urgent
+# security fix is needed
 # ==========================================
-RUN pip install --no-cache-dir --quiet --upgrade --root-user-action=ignore pip=="$PIP_VERSION"
+# TEMPORARY: Update certifi until it gets an
+# update upstream
+# ==========================================
+RUN pip install --no-cache-dir --quiet --upgrade --root-user-action=ignore --uploaded-prior-to=P0D pip=="$PIP_VERSION" certifi=="$CERTIFI_VERSION"
 
 # ==========================================
 # Create an "/app" directory in the root dir
@@ -179,6 +185,7 @@ RUN mkdir -p /app; \
 # ==========================================
 RUN set -eux; \
     curl -sSL "https://install.python-poetry.org" | python -; \
+    "$POETRY_HOME/venv/bin/python" -m pip install --no-cache-dir --quiet --upgrade --uploaded-prior-to=P0D certifi=="$CERTIFI_VERSION"; \
     curl -o- "https://raw.githubusercontent.com/nvm-sh/nvm/v$NVM_VERSION/install.sh" | bash; \
     chown app:app -R "$POETRY_HOME" "$NVM_DIR"