From 115482d00c94630ced2976caa19384d80e04d244 Mon Sep 17 00:00:00 2001 From: "goodbot-agent[bot]" Date: Fri, 23 Oct 2026 18:55:23 +0000 Subject: [PATCH 1/2] [SECURITY-19867] fix: pin Node.js 22.23.4 across runtime images and CI Use the fixed Node.js patch for the app base, local development, CI, and auxiliary runtime images to address CVE-2026-111497. The release image consumes app-base:v2; publishing a rebuilt base and app image is required for the runtime fix to reach alpha. --- .github/workflows/ci.yaml | 2 +- .mise.toml | 2 +- .nvmrc | 2 +- Dockerfile | 2 +- base.Dockerfile | 2 +- scripts/e2b/e2b.Dockerfile | 2 +- sysops/dockerfiles/agent.Dockerfile | 2 +- sysops/dockerfiles/tilt.app.Dockerfile | 2 +- sysops/dockerfiles/workspace-gateway.Dockerfile | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 214a03ee..6c67e63f 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -10,7 +10,7 @@ jobs: strategy: matrix: - node-version: [22.x] + node-version: [22.23.4] steps: - uses: actions/checkout@v4 diff --git a/.mise.toml b/.mise.toml index 4a23b0a4..cb8e03cb 100644 --- a/.mise.toml +++ b/.mise.toml @@ -1,5 +1,5 @@ [tools] -node = "22" +node = "22.23.4" pnpm = "9.15.0" kubectl = "latest" helm = "latest" diff --git a/.nvmrc b/.nvmrc index 2bd5a0a9..b8b23ca9 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -22 +22.23.4 diff --git a/Dockerfile b/Dockerfile index f877ab10..b9b4d2c5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM node:22-slim AS base +FROM node:22.23.4-slim AS base ARG PORT diff --git a/base.Dockerfile b/base.Dockerfile index e41d5e96..b6c39b4a 100644 --- a/base.Dockerfile +++ b/base.Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM node:22-slim +FROM node:22.23.4-slim ARG TARGETARCH diff --git a/scripts/e2b/e2b.Dockerfile b/scripts/e2b/e2b.Dockerfile index 8e055dd3..fae009f0 100644 --- a/scripts/e2b/e2b.Dockerfile +++ b/scripts/e2b/e2b.Dockerfile @@ -9,7 +9,7 @@ # Keep this self-contained instead of depending on lifecycleoss/workspace:latest; the E2B # remote builder needs every gateway contract change baked into the template deterministically. -FROM node:22-slim +FROM node:22.23.4-slim ENV HOME=/home/agent ENV BUN_INSTALL=/home/agent/.bun diff --git a/sysops/dockerfiles/agent.Dockerfile b/sysops/dockerfiles/agent.Dockerfile index d97004d4..227a7cc5 100644 --- a/sysops/dockerfiles/agent.Dockerfile +++ b/sysops/dockerfiles/agent.Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM node:22-slim +FROM node:22.23.4-slim ENV HOME=/home/agent ENV BUN_INSTALL=/home/agent/.bun diff --git a/sysops/dockerfiles/tilt.app.Dockerfile b/sysops/dockerfiles/tilt.app.Dockerfile index b650399e..93727824 100644 --- a/sysops/dockerfiles/tilt.app.Dockerfile +++ b/sysops/dockerfiles/tilt.app.Dockerfile @@ -14,7 +14,7 @@ # limitations under the License. # Use a common base image for both stages -FROM node:22-slim +FROM node:22.23.4-slim # Set environment variables ENV PNPM_HOME="/pnpm" diff --git a/sysops/dockerfiles/workspace-gateway.Dockerfile b/sysops/dockerfiles/workspace-gateway.Dockerfile index 4c6eb4a2..dcc02236 100644 --- a/sysops/dockerfiles/workspace-gateway.Dockerfile +++ b/sysops/dockerfiles/workspace-gateway.Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM node:22-slim +FROM node:22.23.4-slim ENV NPM_CONFIG_UPDATE_NOTIFIER=false ENV NODE_ENV=production From 31c319c269f05867fba7b453f5ee9e10a05232df Mon Sep 17 00:00:00 2001 From: "goodbot-agent[bot]" Date: Fri, 23 Oct 2026 18:55:40 +0000 Subject: [PATCH 2/2] [SECURITY-19867] chore: exclude CI workflow pin without workflows permission The GitHub App cannot push workflow changes. Keep the runtime image and local Node pins in this PR; CI remains on 22.x until a workflow-authorized actor can update it. --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 6c67e63f..214a03ee 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -10,7 +10,7 @@ jobs: strategy: matrix: - node-version: [22.23.4] + node-version: [22.x] steps: - uses: actions/checkout@v4