fix(docker): stop trusting the leaked eMudhra intermediates (0.4.1)

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.4.1
+
+### Security
+
+- The Docker image no longer trusts the eight eMudhra intermediates whose keys leaked: it upgrades Alpine's CA bundle to 20261020-r0 and runs Node with `--use-openssl-ca`, because Node's built-in roots still accept them. The npm package and the Action are not changed by this release: they run on your own Node and your own CA store.
+
 ## 0.4.0
 
 ### Breaking

Dockerfile

@@ -7,6 +7,10 @@ COPY src/ src/
 RUN npm run build
 
 FROM node:26-alpine
+# The base image's CA bundle predates the eMudhra distrust (2026-10-20); run Node
+# on that patched system bundle, because its built-in roots still trust them.
+RUN apk add --no-cache 'ca-certificates-bundle>=20261020-r0'
+ENV NODE_OPTIONS=--use-openssl-ca
 WORKDIR /app
 COPY package.json package-lock.json* ./
 RUN npm ci --omit=dev && npm cache clean --force

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost-github-portfolio",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Write your most starred GitHub repositories to a Ghost page as a grid of cards, through the Ghost Admin API.",
   "type": "module",
   "bin": {