From f7111a5e7743474994398623c443a0c83936099d Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 19:31:35 +0000
Subject: [PATCH 1/2] build(docker): Bump image base to Alpine 3.22.7

Alpine 3.22.7 already ships ca-certificates 20261020-r0, which drops the
distrusted eMudhra/emSign roots, so the base image is clean and the
ca-certificates version pin added in #3447 is no longer needed.

Refs VULN-3216

Co-Authored-By: Geoff Goldsmith <geoff.goldsmith@sentry.io>
---
 CHANGELOG.md | 6 ++++++
 Dockerfile   | 5 ++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f04166c080..c26472c019 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+### Internal Changes
+
+- (docker) Bump the Docker image base from Alpine 3.22.0 to 3.22.7, whose `ca-certificates` already drops the distrusted eMudhra/emSign roots, and remove the `ca-certificates` version pin.
+
 ## 3.8.2
 
 ### Internal Changes
diff --git a/Dockerfile b/Dockerfile
index 181833943c..7b91d070b1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,10 +20,9 @@ RUN touch src/main.rs && cargo build --release --features managed
 # Copy the compiled binary to a target-independent location so it can be picked up later
 RUN cp target/release/sentry-cli /usr/local/bin/sentry-cli
 
-FROM alpine:3.22.0@sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715
+FROM alpine:3.22.7@sha256:2e0b81d60597f449baa56dc25d355367869d2dca4cd57e866f1e2b52af3eb55f
 WORKDIR /work
-# 20261020-r0 removes distrusted eMudhra/emSign root certificates.
-RUN apk add --no-cache 'ca-certificates>=20261020-r0'
+RUN apk add --no-cache ca-certificates
 COPY ./docker-entrypoint.sh /
 COPY --from=sentry-build /usr/local/bin/sentry-cli /bin
 ENTRYPOINT ["/docker-entrypoint.sh"]

From 2727442d57c2d6ff49529899cb18699bc00dd466 Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 13:31:29 +0000
Subject: [PATCH 2/2] build(npm): Bump optional dependencies to 3.8.2 in
 lockfile

The 3.8.2 post-release step timed out waiting for
@sentry/cli-linux-arm64 on npm, so package-lock.json still pinned the
platform packages to 3.8.1 and npm ci failed.

Co-Authored-By: Geoff Goldsmith <geoff.goldsmith@sentry.io>
---
 package-lock.json | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index aa6fd36516..30b6ea014d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1020,35 +1020,51 @@
       }
     },
     "@sentry/cli-darwin": {
-      "version": "3.8.1",
+      "version": "3.8.2",
+      "resolved": "https://registry.npmjs.org/@sentry/cli-darwin/-/cli-darwin-3.8.2.tgz",
+      "integrity": "sha512-S9xIhtpPk5uU0J0dMLz5VCtlBn+OHjG7En8HkZNGYsleNACQOwcG5wcfAnGuq+7x643KrEOubtd1VPtGfrBHsQ==",
       "optional": true
     },
     "@sentry/cli-linux-arm": {
-      "version": "3.8.1",
+      "version": "3.8.2",
+      "resolved": "https://registry.npmjs.org/@sentry/cli-linux-arm/-/cli-linux-arm-3.8.2.tgz",
+      "integrity": "sha512-maj9TXsnyWqNKs+UTHc+/gpsvXPVlCbheH+QHaBx8FD9u0B56REVDfxKUSCzeC9eTGDf0eKAFxbxWiMXKG4B5Q==",
       "optional": true
     },
     "@sentry/cli-linux-arm64": {
-      "version": "3.8.1",
+      "version": "3.8.2",
+      "resolved": "https://registry.npmjs.org/@sentry/cli-linux-arm64/-/cli-linux-arm64-3.8.2.tgz",
+      "integrity": "sha512-sWKkGTSOqRmGW8d2Q6ir1gBEkvfXWNbDxcf/dF0MJt8q9p594k+04GOm5mZ/VAePKGzs9W8fXE1xfmZ/UNCLcQ==",
       "optional": true
     },
     "@sentry/cli-linux-i686": {
-      "version": "3.8.1",
+      "version": "3.8.2",
+      "resolved": "https://registry.npmjs.org/@sentry/cli-linux-i686/-/cli-linux-i686-3.8.2.tgz",
+      "integrity": "sha512-6aOKjTWGl5XEYCOOha4GO3aq5C7ISmYB8QECec8mFLWx0L3QoXdKtaNQoLUYslsSN0jEmFeOgA0U27Tp5OEBww==",
       "optional": true
     },
     "@sentry/cli-linux-x64": {
-      "version": "3.8.1",
+      "version": "3.8.2",
+      "resolved": "https://registry.npmjs.org/@sentry/cli-linux-x64/-/cli-linux-x64-3.8.2.tgz",
+      "integrity": "sha512-icx2NoqaxuE4H5khIoRCB/MDX76/kKbDZFvJe/UYloGp9aucxi6c7mk8oDxFvskMFqLfbprQ6RzKH7iILmODQg==",
       "optional": true
     },
     "@sentry/cli-win32-arm64": {
-      "version": "3.8.1",
+      "version": "3.8.2",
+      "resolved": "https://registry.npmjs.org/@sentry/cli-win32-arm64/-/cli-win32-arm64-3.8.2.tgz",
+      "integrity": "sha512-lSzj1ywih1madjyMrTHSjJKPhvErozSsSrG7QF6yIt7dMLYX4Qh9X3puVReh1YB5mOPCX8MJPtur67YJmR1S+w==",
       "optional": true
     },
     "@sentry/cli-win32-i686": {
-      "version": "3.8.1",
+      "version": "3.8.2",
+      "resolved": "https://registry.npmjs.org/@sentry/cli-win32-i686/-/cli-win32-i686-3.8.2.tgz",
+      "integrity": "sha512-k4dPGNNliNY46G/4hSeJygHlMoyMoL292IO+YP3MasBqyqPEy9hz6Py3FjUVW/Ckso52eoAVtGgb6DntFBjIWA==",
       "optional": true
     },
     "@sentry/cli-win32-x64": {
-      "version": "3.8.1",
+      "version": "3.8.2",
+      "resolved": "https://registry.npmjs.org/@sentry/cli-win32-x64/-/cli-win32-x64-3.8.2.tgz",
+      "integrity": "sha512-IBX5W2M3Zckpg3zOXfnNoayWTKhVlZN/b7ifO7dRArkOsNRzVa2lNB5M7L28O0/ZYu/8V+SnzCoHVGN9bxRdwg==",
       "optional": true
     },
     "@sinclair/typebox": {