Known Issues: frontend row still holds the eMudhra root in the SWC binary

docs/KNOWN_ISSUES.md

@@ -44,7 +44,7 @@
 | `kindest/node:v1.36.4` | Kind node (containerd, kubelet) | AAA Certificate Services; emSign ECC Root CA - G3 | Debian 13 ca-certificates 20250419 (the fixed build is 20250419+deb13u1); containerd 2.3.4 | yes: containerd pulls images that are not in the local registry | none yet (v1.36.4 is still the newest 1.36 node image, the pinned digest is unchanged, and Kind v0.33.0 is the newest Kind release; needs a node image built on the fixed Debian ca-certificates) | open | 2026-11-11, bundle read in image | sandbox |
 | `ghcr.io/blockscout/smart-contract-verifier:v1.11.2` | Contract verifier | none | Ubuntu 24.04 ca-certificates 20260816ubuntu0.24.04.2, used through OpenSSL | yes: downloads Solidity compilers from `binaries.soliditylang.org` | v1.11.1 (published 2026-10-28; v1.11.0 held "emSign ECC Root CA - G3" on Ubuntu ca-certificates 20260601~24.04.1); v1.11.2 (published 2026-11-09) keeps the clean bundle | fixed (adopted v0.13.0, 2026-10-29) | 2026-11-09, bundle read in image | sandbox |
 | `ghcr.io/blockscout/blockscout:v12.0.4` | Explorer backend (source-built; the build upgrades the Alpine CA packages) | emSign ECC Root CA - G3 (certifi 2.17.0 only; castore 1.0.22 and the upgraded Alpine bundle are clean) | app bundle: castore 1.0.22 and certifi 2.17.0; Alpine ca-certificates 20261020-r0 (upgraded by `build-images.sh`; the hexpm base ships 20260909-r0) | yes: token metadata fetches can leave the cluster (market data is disabled) | none yet in a release (certifi 2.18.0 needs hackney ≥ 4.8.6, but v12.0.4 locks hackney 4.8.5, which requires certifi ~> 2.17.0; a build with `mix deps.update hackney certifi` produced hackney 4.10.2 and certifi 2.18.0 with clean bundles, but its runtime behaviour is untested) | open | 2026-11-11, bundle read in image built with the new step | sandbox |
-| `ghcr.io/blockscout/frontend:v2.12.1` | Explorer frontend (source-built with Next.js 16.4.3 in place of the tag's 16.3.5, on Node 24.22.2; see the Blockscout source-build item below) | none | app bundle: Node 24.22.2 built-in roots (118 certificates); Alpine ca-certificates-bundle 20261020-r0 | no: in-cluster backend only | Node 24.22.1 and later (the tag's own base, 24.21.0, still holds "emSign ECC Root CA - G3"); `build-images.sh` moves every frontend stage to `node:24.22.2-alpine` | fixed (adopted v0.14.1, 2026-11-11) | 2026-11-11, bundle and Node roots read in image built with the new step | sandbox |
+| `ghcr.io/blockscout/frontend:v2.12.1` | Explorer frontend (source-built with Next.js 16.4.3 in place of the tag's 16.3.5, on Node 24.22.2; see the Blockscout source-build item below) | emSign ECC Root CA - G3 (embedded in the `@next/swc-linux-arm64-musl` binary under `/app/deploy/tools/sitemap-generator` only; Node's built-in roots and the OS bundle are clean) | app bundle: Node 24.22.2 built-in roots (118 certificates); Alpine ca-certificates-bundle 20261020-r0; the `@next/swc` 16.4.3 binary carries its own root list | no: in-cluster backend only; the SWC binary is not loaded at runtime (the `next-server` process maps only `node_datachannel.node`, and the startup sitemap tool maps no native module) | none yet (the `@next/swc` 16.4.6 binary, the newest, embeds the root as well) | open | 2026-11-11, bundle, Node roots and every `.node` binary read in the running image (public-key and DER match for the SWC binary) | sandbox |
 | NGINX Gateway Fabric `2.8.1` (control plane and nginx data plane) | Gateway controller and proxy | none | Distroless Debian bundle (148 certificates) with Go 1.27.3; Alpine ca-certificates 20261020-r0 (nginx image, 118 certificates) | no: Kubernetes API and in-cluster upstreams only | v2.8.1 (published 2026-11-03; v2.8.0 held "AAA Certificate Services" in the control plane and "emSign ECC Root CA - G3" in the nginx image) | fixed (adopted v0.14.1, 2026-11-11) | 2026-11-11, bundle read in both images | sandbox |
 | `nginxinc/nginx-unprivileged:1.30.6-alpine` | NB UI runtime | emSign ECC Root CA - G3 | Alpine ca-certificates 20260909-r0 | no: inbound only (serves static files) | none yet (the pinned digest is unchanged, and no tag has been pushed since 2026-10-19, including the mainline 1.31.7-alpine, so none carries Alpine ca-certificates 20261020-r0) | open | 2026-11-11, bundle read in image | sandbox |
 | `crytic/slither-action` (Contracts CI) | Static analysis in CI (the action builds its image `FROM python:3.10`) | AAA Certificate Services; emSign ECC Root CA - G3 (system store of the `python:3.10` base) | Debian 13 ca-certificates 20250419 in `python:3.10` (pushed 2026-10-06); `solc-select` fetches through the pip-installed certifi, which was not read | yes: downloads `solc` (and `wget` installs in the action's entrypoint) | none yet (action v0.4.2 from 2026-01-16 is the newest release, and the `python:3.10` tag has not been rebuilt since 2026-10-06; Python 3.10 reached end of life in October 2026) | open | 2026-11-11, bundle read in the `python:3.10` image | sandbox |
@@ -308,6 +308,13 @@
   week old, because upstream's pnpm config sets `minimumReleaseAge` to one
   week. Remove the step once a frontend release tag locks Next.js 16.4.1 or
   later.
+- Correction: the v0.14.1 release notes and the register called the frontend row
+  `fixed`; that overstated it. The Node base and the OS bundle are clean, but the
+  `@next/swc` binary that the image ships for the sitemap generator embeds its own
+  copy of the root list, including "emSign ECC Root CA - G3" (matched by public key
+  and by full certificate DER in `@next/swc-linux-arm64-musl` 16.4.3 and 16.4.6). It
+  is not loaded by the running server or the startup sitemap tool, so the row stays
+  `open` until a Next.js release drops the root.
 - `build-images.sh` also patches two trust-store inputs in the cloned Dockerfiles
   and stops if their text is not found exactly as expected: the backend's
   runtime stage installs with `apk add --upgrade ... ca-certificates