This repository was archived by the owner on Oct 26, 2026. It is now read-only.
Repository navigation
[SECURITY-19867] Pin Node.js to 22.23.4 (CVE-2026-111497) - #1
Draft
goodbot-agent[bot] wants to merge 2 commits into
Draft
goodbot-agent[bot] wants to merge 2 commits into
goodbot-agent[bot] wants to merge 2 commits into
Conversation
Use the fixed Node.js patch for the app base, local development, CI, and auxiliary runtime images to address CVE-2026-111497. The release image consumes app-base:v2; publishing a rebuilt base and app image is required for the runtime fix to reach alpha.
…mission The GitHub App cannot push workflow changes. Keep the runtime image and local Node pins in this PR; CI remains on 22.x until a workflow-authorized actor can update it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.nvmrc, mise, and four additional repo-owned Node runtime Dockerfiles.lifecycleoss/app:alphaimage:.github/workflows/release.yamlbuildsapp.Dockerfileand tags prereleasesalpha.app.Dockerfilecurrently consumeslifecycleoss/app-base:v2, built frombase.Dockerfileby.github/workflows/base-release.yaml. A rebuiltapp-base:v2(or a newly versioned base with an updatedBASE_IMAGE_TAG) and rebuilt app image are required before the pin affectsalpha. Deployment is separate.Validation
git diff --check: passed. All repo-ownedFROM node:lines now specifynode:22.23.4-slim.docker run --rm --entrypoint node lco-check -vcould not run without Docker. The built-image Node version remains unverified and needs checking on a machine with Docker..github/workflows/ci.yamlremains at22.x: the GitHub App rejected a push modifying workflows because it lacksworkflowspermission. A workflow-authorized actor should pin CI to22.23.4.Jira: https://goodrx-dev.atlassian.net/browse/SECURITY-19867
GoodBot session: https://goodbot.grxweb.com/sessions/4d98ca1a-375f-4cfc-bb67-458760d10fa5