From 77dab2d400fc1ff5b2ddd0a7ffbd7217436277cd Mon Sep 17 00:00:00 2001 From: pitoi <814886+pitoi@users.noreply.github.com> Date: Sat, 24 Oct 2026 01:30:06 +0000 Subject: [PATCH] CVE-2026-111497 (group 1): pin Node 22.23.4 Moved the repo from Node 20 to Node 22.23.4 (CVE-2026-111497, Brotli decoder). I changed only two files and did not run a build or any tests. **Changes** - `Dockerfile` lines 1 and 8: `node:20-alpine` is now `node:22.23.4-alpine` in both the builder and runner stages. - `.github/workflows/build-check.yml` line 16: `node-version: '20'` is now `'22.23.4'`. **Left alone** - The other two workflows (`docker-build.yml`, `docker-build-main.yml`) have no Node pin. - There is no `.nvmrc`. - `package.json` has no `engines` field, so I did not add one. - I did not touch `@types/node`, dependencies or the lockfile. - I found no README or docs mention of Node 20. **PR description** - This is part of group 1. The sister PR is in stakwork/hive-relay and has the same title. - This is a Node 20 to 22 major bump. The CI build and a smoke test of the main pages are needed before merge. - After merge, rebuild and push the image `sphinxlightning/graphmindset`. - Every sphinx-swarm host runs it as `:latest`. Each one must pull the new image and restart the container. - Verify on each host with `docker exec node -v`. It should print v22.23.4. - If this can't ship right away, an interim mitigation is to reject `Content-Encoding: br` request bodies at the proxy. Also disable Next.js image optimization until Node is patched. --- .github/workflows/build-check.yml | 2 +- Dockerfile | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-check.yml b/.github/workflows/build-check.yml index bf047951..43dc9331 100644 --- a/.github/workflows/build-check.yml +++ b/.github/workflows/build-check.yml @@ -13,7 +13,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: '20' + node-version: '22.23.4' cache: 'npm' - name: Install diff --git a/Dockerfile b/Dockerfile index 6cfab00e..06dacc70 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,11 +1,11 @@ -FROM node:20-alpine AS builder +FROM node:22.23.4-alpine AS builder WORKDIR /app COPY package.json package-lock.json ./ RUN npm ci COPY . . RUN npm run build -FROM node:20-alpine AS runner +FROM node:22.23.4-alpine AS runner WORKDIR /app ENV NODE_ENV=production ENV HOSTNAME=0.0.0.0