Skip to content

[Deps] Security: patched Node in Docker build and engines floor #1142

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Aymericr merged 1 commit into from
Oct 25, 2026
Merged

[Deps] Security: patched Node in Docker build and engines floor #1142

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,10 @@ WORKDIR /app
# bun (/usr/local/bun-node-fallback-bin/node). Next 16's build crashes it — a
# segfault on 1.3.14, a turbopack CommonJS wrapper error on 1.3.0 — on both arm64
# and amd64. CI does not hit this because GitHub runners have a real node.
RUN apk add --no-cache nodejs
# The floor is the October 2026 Node security release as packaged for this
# image's Alpine 3.24; a minimum rather than an exact pin, so Alpine's later
# rebuilds still install while an older, unpatched index fails the build.
RUN apk add --no-cache 'nodejs>=24.22.1-r0'

COPY . .
RUN bun install --frozen-lockfile
Expand Down
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
"ultracite": "^8.0.2"
},
"engines": {
"node": ">=22.18"
"node": ">=22.23.4"
},
"packageManager": "bun@1.4.4",
"overrides": {
Expand Down
2 changes: 1 addition & 1 deletion packages/cli/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@
"@modelcontextprotocol/server": "^2.4.0"
},
"engines": {
"node": ">=22.13.0"
"node": ">=22.23.4"

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Restrict each Node major to its patched release

For users running newer Node majors, this range does not enforce the security floor described by the change: semver considers vulnerable releases such as Node 24.21.0 and 26.11.0—and unsupported Node 23/25 releases—to satisfy >=22.23.4, so npm emits no engine warning. Express the patched floors per supported major, for example >=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1 <27, and apply the same correction to the root manifest.

Useful? React with 👍 / 👎.

@cursor cursor Bot Oct 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in #1144 (#1144): engines.node is now ^22.23.4 || ^24.22.1 || >=26.12.1 in the root and CLI package.json. That excludes vulnerable 24.x and 26.x releases and the EOL 23 and 25 lines.

},
"keywords": [
"pascal",
Expand Down
Loading