[jpr5]

The published ghcr.io/copilotkit/aimock:latest (1.46.0) runs Node 22.23.3. That version has CVE-2026-111497, a Brotli decompression memory bug. Node 22.23.4 fixes it.

The Dockerfile used the floating node:22-alpine tag. When 1.46.0 was built, that tag resolved to 22.23.3. This PR pins both build stages to node:22.23.4-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914 (the multi-arch index digest). Renovate keeps the digest up to date.

The npm package and CI are not affected. engines is >=20.15.0, and setup-node uses floating majors, so neither pins a version below the fix. The Docker image is rebuilt in a follow-up patch release (1.46.1).

Red / green (local, Docker Desktop buildx)

RED: the published image

$ docker pull ghcr.io/copilotkit/aimock:latest   # label version 1.46.0
$ docker run --rm --entrypoint node ghcr.io/copilotkit/aimock:latest -v
v22.23.3

A local build of the unpinned Dockerfile now gives v22.23.4, because node:22-alpine has moved since 1.46.0 was built (same index digest fe4f6d74…). So the defect is in the published image. Without a pin, the Dockerfile could resolve to any patch version.

GREEN: this branch

$ docker buildx build --builder desktop-linux --load -t aimock:green .
$ docker run --rm --entrypoint node aimock:green -v
v22.23.4
$ docker run -d -p 14010:4010 aimock:green
$ curl -s localhost:14010/health
{"status":"ok"}
$ curl -s -X POST localhost:14010/v1/chat/completions -d '{"model":"gpt-4o","messages":[{"role":"user","content":"hello"}]}'
{"id":"chatcmpl-…","object":"chat.completion",…"content":"Hello! How can I help you today?"…}

Checks

• format:check, lint, typecheck, build: pass
• test: 17603 passed. 8 tests timed out at 5s while the full suite ran under machine load. Their 7 files pass when run alone (561/561). This change touches only Dockerfile and CHANGELOG.md.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@copilotkit/aimock@576

commit: e343ad7