RunicGateway/runicgateway.com
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(docker): pin Node 22.23.4 for the image and CI (Node2Shell)
Some checks failed
PR checks / checks (pull_request) Failing after 2m24s
Details

Browse Source 
CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in Node's
bundled Brotli decoder, fixed on 2026-10-21 in 22.23.4. The image used
the floating node:22-bookworm-slim tag, so a cached or stale base could
still carry an older 22.x. Pin the patched version in both stages and in
the PR checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
This commit is contained in:
claude
2026-10-26 10:01:49 -05:00
parent 9b11c5cb99
commit d59c993430
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Dockerfile
View File

@@ -15,7 +15,7 @@
# ---------------------------------------------------------------------------------------
# Stage 1 — build
# ---------------------------------------------------------------------------------------
FROM node:22-bookworm-slim AS build
FROM node:22.23.4-bookworm-slim AS build
WORKDIR /build
@@ -54,7 +54,7 @@ RUN mkdir -p /split \
# ---------------------------------------------------------------------------------------
# Stage 2 — runtime
# ---------------------------------------------------------------------------------------
FROM node:22-bookworm-slim AS runtime
FROM node:22.23.4-bookworm-slim AS runtime
WORKDIR /app