Repository navigation
chore(security): patch devcontainer Node and refresh CI binaries - #1045
Merged
Merged
Conversation
sybohy
marked this pull request as ready for review
October 24, 2026 05:10
sybohy
changed the title
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace the inherited vulnerable Node 24 binary in the developer container with 24.22.1 for CVE-2026-111497. The existing Node 24 major is preserved. The maintained Microsoft Bookworm base still embeds an older patch, so the Dockerfile copies the actual binary from a digest-pinned official Node image into
/usr/local/bin/nodeand every inherited nvm installation. The build variant is updated to the maintained24-bookwormtag.Validation: the complete devcontainer built successfully. A fresh container directly reports v24.22.1 from login-shell PATH,
/usr/local/bin/node, and nvm after its initialization script is sourced. Package validation used the SHA256-verified Node 24.22.1 runtime:npm ci: passednpm run typecheck: passednpm run build: passednpm test -- --concurrency=2: passedCI keeps its supported-major coverage and stable protected job labels, and now sets
check-latest: trueon every floatingsetup-nodeinvocation (shared action and direct package-install jobs). This resolves the latest patch before choosing a hosted cached binary. Consumer engine declarations, dependencies and lockfiles remain unchanged. Rebuild developer containers after merge; a cached old image is not remediated by the source edit. This development-image change does not require an npm/CDN release or replace downstream server runtimes. No release, provider setting change, merge or deployment was performed.The final cache-resolution Check run passed. Its actual setup logs report
v22.23.4,v24.22.1. All PR checks are green.Resolver behavior: official setup-node documentation.