From 6d13a9b4677c79e268d1b31aa5b7eaede7eba357 Mon Sep 17 00:00:00 2001 From: vmelikyan Date: Fri, 23 Oct 2026 15:11:07 -0700 Subject: [PATCH] chore: pin Node.js to 22.23.4 Node 22.23.4 fixes CVE-2026-111497 (Brotli decoder out-of-bounds write). Pin the exact patch in every Node base image, .nvmrc and mise so a cached node:22-slim cannot resolve to an unpatched release. --- .mise.toml | 2 +- .nvmrc | 2 +- Dockerfile | 2 +- base.Dockerfile | 2 +- scripts/e2b/e2b.Dockerfile | 2 +- sysops/dockerfiles/agent.Dockerfile | 2 +- sysops/dockerfiles/tilt.app.Dockerfile | 2 +- sysops/dockerfiles/workspace-gateway.Dockerfile | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.mise.toml b/.mise.toml index 4a23b0a4..cb8e03cb 100644 --- a/.mise.toml +++ b/.mise.toml @@ -1,5 +1,5 @@ [tools] -node = "22" +node = "22.23.4" pnpm = "9.15.0" kubectl = "latest" helm = "latest" diff --git a/.nvmrc b/.nvmrc index 2bd5a0a9..b8b23ca9 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -22 +22.23.4 diff --git a/Dockerfile b/Dockerfile index f877ab10..b9b4d2c5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM node:22-slim AS base +FROM node:22.23.4-slim AS base ARG PORT diff --git a/base.Dockerfile b/base.Dockerfile index e41d5e96..b6c39b4a 100644 --- a/base.Dockerfile +++ b/base.Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM node:22-slim +FROM node:22.23.4-slim ARG TARGETARCH diff --git a/scripts/e2b/e2b.Dockerfile b/scripts/e2b/e2b.Dockerfile index 8e055dd3..fae009f0 100644 --- a/scripts/e2b/e2b.Dockerfile +++ b/scripts/e2b/e2b.Dockerfile @@ -9,7 +9,7 @@ # Keep this self-contained instead of depending on lifecycleoss/workspace:latest; the E2B # remote builder needs every gateway contract change baked into the template deterministically. -FROM node:22-slim +FROM node:22.23.4-slim ENV HOME=/home/agent ENV BUN_INSTALL=/home/agent/.bun diff --git a/sysops/dockerfiles/agent.Dockerfile b/sysops/dockerfiles/agent.Dockerfile index d97004d4..227a7cc5 100644 --- a/sysops/dockerfiles/agent.Dockerfile +++ b/sysops/dockerfiles/agent.Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM node:22-slim +FROM node:22.23.4-slim ENV HOME=/home/agent ENV BUN_INSTALL=/home/agent/.bun diff --git a/sysops/dockerfiles/tilt.app.Dockerfile b/sysops/dockerfiles/tilt.app.Dockerfile index b650399e..93727824 100644 --- a/sysops/dockerfiles/tilt.app.Dockerfile +++ b/sysops/dockerfiles/tilt.app.Dockerfile @@ -14,7 +14,7 @@ # limitations under the License. # Use a common base image for both stages -FROM node:22-slim +FROM node:22.23.4-slim # Set environment variables ENV PNPM_HOME="/pnpm" diff --git a/sysops/dockerfiles/workspace-gateway.Dockerfile b/sysops/dockerfiles/workspace-gateway.Dockerfile index 4c6eb4a2..dcc02236 100644 --- a/sysops/dockerfiles/workspace-gateway.Dockerfile +++ b/sysops/dockerfiles/workspace-gateway.Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM node:22-slim +FROM node:22.23.4-slim ENV NPM_CONFIG_UPDATE_NOTIFIER=false ENV NODE_ENV=production