wtclaude d59c993430 fix(docker): pin Node 22.23.4 for the image and CI (Node2Shell) ...

CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in Node's
bundled Brotli decoder, fixed on 2026-10-21 in 22.23.4. The image used
the floating node:22-bookworm-slim tag, so a cached or stale base could
still carry an older 22.x. Pin the patched version in both stages and in
the PR checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

2026-10-26 10:01:49 -05:00

..

build-image.yml

fix(image): ship node_modules in three layers, and count them before pushing

2026-08-26 23:10:34 -05:00

pr-checks.yml

fix(docker): pin Node 22.23.4 for the image and CI (Node2Shell)

2026-10-26 10:01:49 -05:00