starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-27 00:02:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: pin node to 24.22.1 in the worker image for CVE-2026-111497 (#11995)

Browse Source 
* chore: update node to 26 in the docker image and CI

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: pin node to 24.22.1 in the worker image for CVE-2026-111497

The unpinned NodeSource install was served from the build cache, so images
built after the security release still shipped 24.22.0. Reverts the node 26
bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Ruben Fiszel
2026-10-25 03:19:38 +01:00
committed by GitHub
co-authored by Claude Opus 5.5
parent 34a01cc61a
commit 0e79e934b6
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+5 -2
View File
@@ -144,6 +144,9 @@ ARG KUBECTL_VERSION=1.37.1
ARG HELM_VERSION=3.21.4
# NOTE: If changing, also change go version in workspace dependencies template at WorkspaceDependenciesEditor.svelte
ARG GO_VERSION=1.27.1
# Pinned to the patch: an unpinned install is cached by the image build and stops picking up
# security releases.
ARG NODE_VERSION=24.22.1
ARG APP=/usr/src/app
ARG WITH_POWERSHELL=true
ARG WITH_KUBECTL=true
@@ -252,8 +255,8 @@ RUN UV_CACHE_DIR=/tmp/build_cache/uv UV_PYTHON_INSTALL_DIR=/tmp/build_cache/py_r
RUN UV_CACHE_DIR=/tmp/build_cache/uv UV_PYTHON_INSTALL_DIR=/tmp/build_cache/py_runtime uv python install $NEW_INSTANCE_PY --compile-bytecode
RUN curl -sL https://deb.nodesource.com/setup_24.x | bash -
RUN apt-get -y update && apt-get install -y --no-install-recommends curl procps nodejs awscli && apt-get clean \
RUN curl -sL https://deb.nodesource.com/setup_${NODE_VERSION%%.*}.x | bash -
RUN apt-get -y update && apt-get install -y --no-install-recommends curl procps nodejs=${NODE_VERSION}-1nodesource1 awscli && apt-get clean \
&& rm -rf /var/lib/apt/lists/*
# The npm bundled with nodejs is replaced by a pinned one: it is what `//npm` scripts install with