From 6513b0ccb5a3dcd9785802168c2b40dd353db1ae Mon Sep 17 00:00:00 2001 From: Sy Bohy Date: Fri, 23 Oct 2026 21:44:30 -0700 Subject: [PATCH 1/4] fix: use patched Node releases for component tooling --- .devcontainer/Dockerfile | 9 +++++++-- .devcontainer/devcontainer.json | 2 +- .github/actions/setup/action.yml | 2 +- .github/workflows/_build.yml | 2 +- .github/workflows/_publish.yml | 2 +- .github/workflows/check.yml | 16 ++++++++-------- .nvmrc | 2 +- 7 files changed, 20 insertions(+), 15 deletions(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 3777f5be5..765b62311 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -1,6 +1,11 @@ -ARG VARIANT="20" +ARG VARIANT="22-bookworm" -FROM mcr.microsoft.com/vscode/devcontainers/javascript-node:${VARIANT} +FROM mcr.microsoft.com/devcontainers/javascript-node:1-${VARIANT} + +# Refresh the bundled Node binary; a supported-major image can contain an older patch. +USER root +RUN su node -c "source /usr/local/share/nvm/nvm.sh && nvm install 22.23.4 && nvm alias default 22.23.4" +ENV PATH="/usr/local/share/nvm/versions/node/v22.23.4/bin:${PATH}" USER node WORKDIR /home/node diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 28b9ad608..b6f6c789c 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -3,7 +3,7 @@ "build": { "dockerfile": "Dockerfile", "args": { - "VARIANT": "20" + "VARIANT": "22-bookworm" } }, "hostRequirements": { diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml index c7705998b..a20c32058 100644 --- a/.github/actions/setup/action.yml +++ b/.github/actions/setup/action.yml @@ -6,7 +6,7 @@ inputs: node_version: description: The Node.js version. required: false - default: '20' + default: '22.23.4' registry_url: description: The Node.js package registry URL. required: false diff --git a/.github/workflows/_build.yml b/.github/workflows/_build.yml index 92a145054..4445252ee 100644 --- a/.github/workflows/_build.yml +++ b/.github/workflows/_build.yml @@ -8,7 +8,7 @@ on: description: The Node.js version. type: string required: false - default: '20' + default: '22.23.4' outputs: artifact_name: description: The artifact name. diff --git a/.github/workflows/_publish.yml b/.github/workflows/_publish.yml index 669c995a3..327e71288 100644 --- a/.github/workflows/_publish.yml +++ b/.github/workflows/_publish.yml @@ -28,7 +28,7 @@ jobs: - name: Setup uses: ./.github/actions/setup with: - node_version: '24' + node_version: '24.22.1' install_dependencies: 'false' - name: Download artifact uses: actions/download-artifact@v6 diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 96fd5787f..6d3064793 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -20,8 +20,8 @@ jobs: os: - ubuntu-latest node: - - '18' - - '20' + - '22.23.4' + - '24.22.1' include: - os: ubuntu-latest os_name: Linux @@ -42,8 +42,8 @@ jobs: fail-fast: false matrix: node: - - '18' - - '20' + - '22.23.4' + - '24.22.1' steps: - name: Checkout uses: actions/checkout@v4 @@ -67,8 +67,8 @@ jobs: os: - ubuntu-latest node: - - '18' - - '20' + - '22.23.4' + - '24.22.1' include: - os: ubuntu-latest os_name: Linux @@ -113,8 +113,8 @@ jobs: fail-fast: false matrix: node: - - '18' - - '20' + - '22.23.4' + - '24.22.1' steps: - name: Checkout uses: actions/checkout@v4 diff --git a/.nvmrc b/.nvmrc index 209e3ef4b..b8b23ca93 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -20 +22.23.4 From 8640e17c9edddc68fc0b78c2e34a2e7513113816 Mon Sep 17 00:00:00 2001 From: Sy Bohy Date: Fri, 23 Oct 2026 21:47:50 -0700 Subject: [PATCH 2/4] fix: use Bash explicitly for devcontainer nvm install --- .devcontainer/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 765b62311..a9b00dcbd 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -4,7 +4,7 @@ FROM mcr.microsoft.com/devcontainers/javascript-node:1-${VARIANT} # Refresh the bundled Node binary; a supported-major image can contain an older patch. USER root -RUN su node -c "source /usr/local/share/nvm/nvm.sh && nvm install 22.23.4 && nvm alias default 22.23.4" +RUN su -s /bin/bash node -c "source /usr/local/share/nvm/nvm.sh && nvm install 22.23.4 && nvm alias default 22.23.4" ENV PATH="/usr/local/share/nvm/versions/node/v22.23.4/bin:${PATH}" USER node From 769301b65ced7e406c46b0f3f6cb8766730a648a Mon Sep 17 00:00:00 2001 From: Sy Bohy Date: Fri, 23 Oct 2026 21:55:36 -0700 Subject: [PATCH 3/4] fix(ci): keep Node check labels stable by major --- .github/workflows/check.yml | 42 ++++++++++++++++++++++++++----------- 1 file changed, 30 insertions(+), 12 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 6d3064793..4c32498fe 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -20,18 +20,22 @@ jobs: os: - ubuntu-latest node: - - '22.23.4' - - '24.22.1' + - '22' + - '24' include: - os: ubuntu-latest os_name: Linux + - node: '22' + node_version: '22.23.4' + - node: '24' + node_version: '24.22.1' steps: - name: Checkout uses: actions/checkout@v4 - name: Setup uses: ./.github/actions/setup with: - node_version: ${{ matrix.node }} + node_version: ${{ matrix.node_version }} - name: Test run: npm test lint: @@ -42,15 +46,20 @@ jobs: fail-fast: false matrix: node: - - '22.23.4' - - '24.22.1' + - '22' + - '24' + include: + - node: '22' + node_version: '22.23.4' + - node: '24' + node_version: '24.22.1' steps: - name: Checkout uses: actions/checkout@v4 - name: Setup uses: ./.github/actions/setup with: - node_version: ${{ matrix.node }} + node_version: ${{ matrix.node_version }} - name: Lint run: npm run lint build: @@ -67,16 +76,20 @@ jobs: os: - ubuntu-latest node: - - '22.23.4' - - '24.22.1' + - '22' + - '24' include: - os: ubuntu-latest os_name: Linux + - node: '22' + node_version: '22.23.4' + - node: '24' + node_version: '24.22.1' steps: - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: ${{ matrix.node }} + node-version: ${{ matrix.node_version }} - name: Download artifact uses: actions/download-artifact@v4 with: @@ -113,15 +126,20 @@ jobs: fail-fast: false matrix: node: - - '22.23.4' - - '24.22.1' + - '22' + - '24' + include: + - node: '22' + node_version: '22.23.4' + - node: '24' + node_version: '24.22.1' steps: - name: Checkout uses: actions/checkout@v4 - name: Setup uses: ./.github/actions/setup with: - node_version: ${{ matrix.node }} + node_version: ${{ matrix.node_version }} - name: Typecheck run: npm run typecheck docs: From d3e80ab731a55272a515cbe42a9f4bdb3b280660 Mon Sep 17 00:00:00 2001 From: Sy Bohy Date: Fri, 23 Oct 2026 22:05:41 -0700 Subject: [PATCH 4/4] fix(security): replace inherited devcontainer Node binaries --- .devcontainer/Dockerfile | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index a9b00dcbd..320ece885 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -1,11 +1,20 @@ ARG VARIANT="22-bookworm" +FROM node:22.23.4-bookworm-slim@sha256:de170b39439eb0e5a3444ad7d60b015614a381e10fecae2e30ec9e735122f38d AS patched-node + FROM mcr.microsoft.com/devcontainers/javascript-node:1-${VARIANT} -# Refresh the bundled Node binary; a supported-major image can contain an older patch. -USER root -RUN su -s /bin/bash node -c "source /usr/local/share/nvm/nvm.sh && nvm install 22.23.4 && nvm alias default 22.23.4" -ENV PATH="/usr/local/share/nvm/versions/node/v22.23.4/bin:${PATH}" +# Patch the system binary and every inherited nvm copy used by interactive shells. +COPY --from=patched-node /usr/local/bin/node /tmp/patched-node +RUN install -m 0755 /tmp/patched-node /usr/local/bin/node \ + && if [ -d /usr/local/share/nvm/versions/node ]; then \ + find /usr/local/share/nvm/versions/node -type f -path "*/bin/node" \ + -exec install -m 0755 /tmp/patched-node {} \; ; \ + fi \ + && rm /tmp/patched-node \ + && test "$(node --version)" = "v22.23.4" \ + && test "$(/usr/local/bin/node --version)" = "v22.23.4" +ENV NODE_VERSION=22.23.4 USER node WORKDIR /home/node