From 1b26678b9f48dc3ceb409b953e35d362e6ad9ca5 Mon Sep 17 00:00:00 2001
From: GeiserX <9169332+GeiserX@users.noreply.github.com>
Date: Wed, 21 Oct 2026 00:47:07 +0200
Subject: [PATCH 1/2] fix(docker): stop trusting the leaked eMudhra
 intermediates (0.4.1)

---
 CHANGELOG.md      | 6 ++++++
 Dockerfile        | 4 ++++
 package-lock.json | 4 ++--
 package.json      | 2 +-
 4 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 059a117..4d341a7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.4.1
+
+### Security
+
+- The Docker image no longer trusts the eight eMudhra intermediates whose keys leaked: it upgrades Alpine's CA bundle to 20261020-r0 and runs Node with `--use-openssl-ca`, because Node's built-in roots still accept them. The npm package and the Action run on your own Node, which needs the same flag and a patched system bundle.
+
 ## 0.4.0
 
 ### Breaking
diff --git a/Dockerfile b/Dockerfile
index 86ed59b..932ec18 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,6 +7,10 @@ COPY src/ src/
 RUN npm run build
 
 FROM node:26-alpine
+# The base image's CA bundle predates the eMudhra distrust (2026-10-20); run Node
+# on that patched system bundle, because its built-in roots still trust them.
+RUN apk upgrade --no-cache ca-certificates-bundle
+ENV NODE_OPTIONS=--use-openssl-ca
 WORKDIR /app
 COPY package.json package-lock.json* ./
 RUN npm ci --omit=dev && npm cache clean --force
diff --git a/package-lock.json b/package-lock.json
index e815e0d..34f3930 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "ghost-github-portfolio",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "ghost-github-portfolio",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "license": "GPL-3.0-or-later",
       "dependencies": {
         "commander": "^13.1.0",
diff --git a/package.json b/package.json
index f1648c2..4ba19e7 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ghost-github-portfolio",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Write your most starred GitHub repositories to a Ghost page as a grid of cards, through the Ghost Admin API.",
   "type": "module",
   "bin": {

From 0533679523292945b08da3fa9d68739c86bbcc0e Mon Sep 17 00:00:00 2001
From: GeiserX <9169332+GeiserX@users.noreply.github.com>
Date: Wed, 21 Oct 2026 00:59:53 +0200
Subject: [PATCH 2/2] fix(docker): require the patched CA bundle version, and
 say the npm package is unchanged

---
 CHANGELOG.md | 2 +-
 Dockerfile   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4d341a7..650ac2e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### Security
 
-- The Docker image no longer trusts the eight eMudhra intermediates whose keys leaked: it upgrades Alpine's CA bundle to 20261020-r0 and runs Node with `--use-openssl-ca`, because Node's built-in roots still accept them. The npm package and the Action run on your own Node, which needs the same flag and a patched system bundle.
+- The Docker image no longer trusts the eight eMudhra intermediates whose keys leaked: it upgrades Alpine's CA bundle to 20261020-r0 and runs Node with `--use-openssl-ca`, because Node's built-in roots still accept them. The npm package and the Action are not changed by this release: they run on your own Node and your own CA store.
 
 ## 0.4.0
 
diff --git a/Dockerfile b/Dockerfile
index 932ec18..7512308 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,7 +9,7 @@ RUN npm run build
 FROM node:26-alpine
 # The base image's CA bundle predates the eMudhra distrust (2026-10-20); run Node
 # on that patched system bundle, because its built-in roots still trust them.
-RUN apk upgrade --no-cache ca-certificates-bundle
+RUN apk add --no-cache 'ca-certificates-bundle>=20261020-r0'
 ENV NODE_OPTIONS=--use-openssl-ca
 WORKDIR /app
 COPY package.json package-lock.json* ./