From 0e79e934b6342150ee31de08a19400de482b1969 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Sat, 24 Oct 2026 19:19:38 -0700 Subject: [PATCH] fix: pin node to 24.22.1 in the worker image for CVE-2026-111497 (#11995) * chore: update node to 26 in the docker image and CI Co-Authored-By: Claude Opus 5.5 * fix: pin node to 24.22.1 in the worker image for CVE-2026-111497 The unpinned NodeSource install was served from the build cache, so images built after the security release still shipped 24.22.0. Reverts the node 26 bump. Co-Authored-By: Claude Opus 5.5 --------- Co-authored-by: Claude Opus 5.5 --- Dockerfile | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index ad3a79a2b6..93862fe0b9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -144,6 +144,9 @@ ARG KUBECTL_VERSION=1.37.1 ARG HELM_VERSION=3.21.4 # NOTE: If changing, also change go version in workspace dependencies template at WorkspaceDependenciesEditor.svelte ARG GO_VERSION=1.27.1 +# Pinned to the patch: an unpinned install is cached by the image build and stops picking up +# security releases. +ARG NODE_VERSION=24.22.1 ARG APP=/usr/src/app ARG WITH_POWERSHELL=true ARG WITH_KUBECTL=true @@ -252,8 +255,8 @@ RUN UV_CACHE_DIR=/tmp/build_cache/uv UV_PYTHON_INSTALL_DIR=/tmp/build_cache/py_r RUN UV_CACHE_DIR=/tmp/build_cache/uv UV_PYTHON_INSTALL_DIR=/tmp/build_cache/py_runtime uv python install $NEW_INSTANCE_PY --compile-bytecode -RUN curl -sL https://deb.nodesource.com/setup_24.x | bash - -RUN apt-get -y update && apt-get install -y --no-install-recommends curl procps nodejs awscli && apt-get clean \ +RUN curl -sL https://deb.nodesource.com/setup_${NODE_VERSION%%.*}.x | bash - +RUN apt-get -y update && apt-get install -y --no-install-recommends curl procps nodejs=${NODE_VERSION}-1nodesource1 awscli && apt-get clean \ && rm -rf /var/lib/apt/lists/* # The npm bundled with nodejs is replaced by a pinned one: it is what `//npm` scripts install with