From d59c9934304e177d60d0dddc396c326d6c03eb69 Mon Sep 17 00:00:00 2001
From: wtclaude <claude@whitlocktech.net>
Date: Mon, 26 Oct 2026 10:01:49 -0500
Subject: [PATCH 1/2] fix(docker): pin Node 22.23.4 for the image and CI
 (Node2Shell)

CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in Node's
bundled Brotli decoder, fixed on 2026-10-21 in 22.23.4. The image used
the floating node:22-bookworm-slim tag, so a cached or stale base could
still carry an older 22.x. Pin the patched version in both stages and in
the PR checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
---
 .gitea/workflows/pr-checks.yml | 2 +-
 Dockerfile                     | 4 ++--
 README.md                      | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/pr-checks.yml b/.gitea/workflows/pr-checks.yml
index 8fbf471..2ad1be6 100644
--- a/.gitea/workflows/pr-checks.yml
+++ b/.gitea/workflows/pr-checks.yml
@@ -22,7 +22,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: '22.23.4'
           cache: npm
 
       - name: Install
diff --git a/Dockerfile b/Dockerfile
index 888aca4..9848166 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,7 +15,7 @@
 # ---------------------------------------------------------------------------------------
 # Stage 1 — build
 # ---------------------------------------------------------------------------------------
-FROM node:22-bookworm-slim AS build
+FROM node:22.23.4-bookworm-slim AS build
 
 WORKDIR /build
 
@@ -54,7 +54,7 @@ RUN mkdir -p /split \
 # ---------------------------------------------------------------------------------------
 # Stage 2 — runtime
 # ---------------------------------------------------------------------------------------
-FROM node:22-bookworm-slim AS runtime
+FROM node:22.23.4-bookworm-slim AS runtime
 
 WORKDIR /app
 
diff --git a/README.md b/README.md
index 3054dee..8534169 100644
--- a/README.md
+++ b/README.md
@@ -32,7 +32,7 @@ npm run build        # → dist/  (prerendered pages + the Node server entry)
 npm start            # serve the built site
 ```
 
-Node 22 LTS or newer. Nothing else — no database, no game server, no container runtime.
+Node 22.23.4+ (or 24.22.1+); older builds carry the Node2Shell Brotli bug, CVE-2026-111497. Nothing else — no database, no game server, no container runtime.
 
 ## Running it in production
 
-- 
2.49.1


From e7bbc250a5714159ccf19c11cf9d7bc1c0b2e200 Mon Sep 17 00:00:00 2001
From: wtclaude <claude@whitlocktech.net>
Date: Tue, 27 Oct 2026 12:37:48 -0500
Subject: [PATCH 2/2] chore(facts): Module API 1.19.0, Module-Rust v0.6.0

checkFacts turned this PR red on drift from the demo-mode merges, not on
the Node change: website main is at MODULE_API 1.19.0, Module-Rust main
declares coreApi ^1.19.0, and Module-Rust released v0.6.0. Every page
reads the three values from platform.json; verifiedOn moves to today.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
---
 src/data/platform.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/data/platform.json b/src/data/platform.json
index 624d6bb..ae237f9 100644
--- a/src/data/platform.json
+++ b/src/data/platform.json
@@ -12,14 +12,14 @@
     "wrong protocol number in the first place."
   ],
 
-  "verifiedOn": "2026-10-23",
+  "verifiedOn": "2026-10-27",
 
   "$comment_moduleApi": [
     "The one version every deployment shares, whichever game it runs. D66: it is the only",
     "version the homepage hero and the footer show — a protocol and a bundle belong to a game,",
     "so they appear on that game's own pages."
   ],
-  "moduleApi": "1.17.0",
+  "moduleApi": "1.19.0",
 
   "$comment_releases": [
     "Every repository whose release the site quotes, flat, so checkFacts.mjs reads them all",
@@ -32,7 +32,7 @@
     "Module-uo": "v1.3.0",
     "Rust-Link": "v0.3.0",
     "Rust-Plugins": "v0.3.0",
-    "Module-Rust": "v0.5.1",
+    "Module-Rust": "v0.6.0",
     "runicnpc-rust": "v1.0.0"
   },
 
@@ -79,7 +79,7 @@
       "protocol": 14,
       "module": {
         "repo": "Module-Rust",
-        "coreApi": "^1.17.0",
+        "coreApi": "^1.19.0",
         "capabilities": ["rust", "servers", "killfeed", "leaderboard", "presence", "wipes", "identity", "map"]
       },
       "sidecarRepo": "Rust-Link",
-- 
2.49.1