Runtime images pin Node 22.16.0 / 24.18.0 / 26.4.0, missing the 2026-10-21 security release (CVE-2026-111497) #5046

trigger.dev CLI 4.7.6 pins runtime images by digest (dist/esm/deploy/buildImage.js). NODE_VERSION behind each pinned digest:

• node-22: triggerdotdev/node:22-bookworm@sha256:3d1b59a1d50c… = 22.16.0
• node-24: triggerdotdev/node:24-bookworm@sha256:d2d0c0182240… = 24.18.0
• node-26: triggerdotdev/node:26-bookworm@sha256:0e9b19f814f3… = 26.4.0

The 2026-10-21 Node.js security release (22.23.4, 24.22.1, 26.12.1) fixes CVE-2026-111497, a Brotli decoder out-of-bounds write that the advisory says permits remote code execution: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Any task that calls fetch() on a URL it does not control reaches it, because undici decompresses Content-Encoding: br responses. node-22 also misses the 2025-07, 2026-01, 2026-03, 2026-06 and 2026-07 security releases.

Ask: rebuild the runtime images on the patched versions and ship a CLI release that pins the new digests. A documented cadence for following Node security releases would help users plan.

Repro: npx [email protected] deploy --dry-run, then read NODE_VERSION of the FROM image in the generated Containerfile.