[heygengenesis]

What

Moves the hyperframes image Node pins to the Node.js November 2026 security release. The fixed 22.x build is 22.23.5.

Image	Before	After
packages/cli/src/docker/Dockerfile.render (hyperframes render --docker)	node:22.23.4-bookworm-slim	node:22.23.5-bookworm-slim
packages/gcp-cloud-run/Dockerfile	node:22.23.4-bookworm-slim@sha256:5ec23b…	node:22.23.5-bookworm-slim@sha256:e9f565…
Dockerfile.test (producer regression image)	node:22.23.4-bookworm-slim	node:22.23.5-bookworm-slim
packages/aws-lambda/image/Dockerfile (arm64 video function base)	public.ecr.aws/lambda/nodejs:22@sha256:d138ef… (22.23.4, built Oct 22)	public.ecr.aws/lambda/nodejs:22@sha256:f571ad… (22.23.5, built Nov 12)

Why

On Nov 11 Node.js shipped 16 CVEs, 7 of them rated High. Fixes are in 22.23.5, 24.22.3 and 26.13.1. Exact-version and digest pins don't pick up a fix when the image is rebuilt, so the pins have to change. The previous bump (#6440) moved these same pins to 22.23.4.

Cloud Run runs the server under Bun (CMD ["bun", …]). These are CVEs in Node's own code, not in a shared library like Brotli was, so Bun isn't affected and stays at 1.4.4. The Node base still ships in that image, so the pin moves with the others.

Related work

Refs #6440 (previous Node pin bump, CVE-2026-111497). Node advisory: https://nodejs.org/en/blog/vulnerability/november-2026-security-releases

How

Version and digest pins only. The changelog and release notes are left alone because they're generated at release.

I read each new digest back from its registry rather than copying it from a web page:

• Docker Hub node:22.23.5-bookworm-slim: index sha256:e9f565d3…. The amd64 image config has NODE_VERSION=22.23.5.
• Public ECR lambda/nodejs:22: index sha256:f571ad6b…, arm64 config created 2026-11-12. Lambda images don't set NODE_VERSION, so I pulled the arm64 layer and read include/node/node_version.h, which says 22.23.5. The old d138ef… image was built 2026-10-22, the 22.23.4 build fix(docker): Node 22.23.4 and Bun 1.4.4 for CVE-2026-111497 (Brotli) #6440 verified.

Test plan

• Unit tests added/updated: not applicable (pins only)
• Manual testing performed: verified each tag and digest against its registry as described above
• Documentation updated (if applicable): not applicable
• Comments follow CONTRIBUTING.md "Comments": no comments added
• CI builds the images.

Genesis session: https://genesis.hg.dev/v2/sessions/edfa37eb-f90b-513f-9f8e-cf948cdbfd52
Session owner: joel.gallardo@heygen.com

🤖 Generated with Claude Code

[joelgallardoclippy-lgtm]

Each pin checks out against its registry:

• node@sha256:e9f565… is an OCI index with NODE_VERSION=22.23.5 on amd64 and arm64. It is what node:22.23.5-bookworm-slim resolves to today. The old 5ec23b… is 22.23.4.
• public.ecr.aws/lambda/nodejs@sha256:f571ad… is a manifest list (arm64 + amd64) and is what :22 resolves to today. The arm64 config was created 2026-11-12, and include/node/node_version.h in layer 2181fc08… reads 22.23.5. The old d138ef… was built 2026-10-22.
• No other Node 22.23.x pins or node digests remain. examples/k8s-jobs/Dockerfile.example and packages/aws-lambda/scripts/probe-beginframe.dockerfile use floating tags. The deployed Lambda functions use the AWS-managed NODEJS_22_X runtime (packages/aws-lambda/src/cdk/HyperframesRenderStack.ts:108), which AWS patches. The arm64 image here only builds the ffmpeg artifact.
• The image checks ran and passed on this head: GCP BeginFrame image contract, ffmpeg builds match, Image smoke (lambda-arm64-image.yml) and the regression shards. All required checks are green.

No blockers or important findings.

Verdict: APPROVE
Reasoning: A version-and-digest-only change where every new reference is checked against the registry for the arches it builds on, nothing was missed, and the image-level CI passed.

— Clippy