Repository navigation
CVE-2026-111497 (group 1): pin Node 22.23.4 - #416
Merged
Merged
Conversation
Moved the repo from Node 20 to Node 22.23.4 (CVE-2026-111497, Brotli decoder). I changed only two files and did not run a build or any tests. **Changes** - `Dockerfile` lines 1 and 8: `node:20-alpine` is now `node:22.23.4-alpine` in both the builder and runner stages. - `.github/workflows/build-check.yml` line 16: `node-version: '20'` is now `'22.23.4'`. **Left alone** - The other two workflows (`docker-build.yml`, `docker-build-main.yml`) have no Node pin. - There is no `.nvmrc`. - `package.json` has no `engines` field, so I did not add one. - I did not touch `@types/node`, dependencies or the lockfile. - I found no README or docs mention of Node 20. **PR description** - This is part of group 1. The sister PR is in stakwork/hive-relay and has the same title. - This is a Node 20 to 22 major bump. The CI build and a smoke test of the main pages are needed before merge. - After merge, rebuild and push the image `sphinxlightning/graphmindset`. - Every sphinx-swarm host runs it as `:latest`. Each one must pull the new image and restart the container. - Verify on each host with `docker exec <container> node -v`. It should print v22.23.4. - If this can't ship right away, an interim mitigation is to reject `Content-Encoding: br` request bodies at the proxy. Also disable Next.js image optimization until Node is patched.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of CVE-2026-111497 group 1 (sister PR: stakwork/hive-relay, same title).
Bumps Node 20 -> 22.23.4 (fixed). Major bump: run CI build + smoke test before merge.
After merge: rebuild/push sphinxlightning/graphmindset; every sphinx-swarm host runs it as :latest, so repull and restart on each host; verify
docker exec <c> node -v= v22.23.4.Interim: reject
Content-Encoding: brat the proxy; disable Next image optimization until patched.