RunicGateway/runicgateway.com
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(docker): pin Node 22.23.4 for the image and CI (Node2Shell) #41

Merged
whitlocktech merged 2 commits from fix/node22-node2shell into main 2026-10-27 12:49:08 -05:00
Conversation 0 Commits 2 Files Changed 4 +8 -8

2 Commits

Author SHA1 Message Date
wtclaude
e7bbc250a5 chore(facts): Module API 1.19.0, Module-Rust v0.6.0
All checks were successful
PR checks / checks (pull_request) Successful in 5m58s
Details 
checkFacts turned this PR red on drift from the demo-mode merges, not on
the Node change: website main is at MODULE_API 1.19.0, Module-Rust main
declares coreApi ^1.19.0, and Module-Rust released v0.6.0. Every page
reads the three values from platform.json; verifiedOn moves to today.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
 2026-10-27 12:37:48 -05:00
wtclaude
d59c993430 fix(docker): pin Node 22.23.4 for the image and CI (Node2Shell)
Some checks failed
PR checks / checks (pull_request) Failing after 2m24s
Details 
CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in Node's
bundled Brotli decoder, fixed on 2026-10-21 in 22.23.4. The image used
the floating node:22-bookworm-slim tag, so a cached or stale base could
still carry an older 22.x. Pin the patched version in both stages and in
the PR checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
 2026-10-26 10:01:49 -05:00