From faee7fedcd52774fc247642b27d816459ca75bca Mon Sep 17 00:00:00 2001 From: "Jude.Chen" Date: Thu, 22 Oct 2026 10:25:19 +0800 Subject: [PATCH] chore(deps): pin Node 22.23.4 for the October 2026 security release CI was hard-pinned to Node 22.12.0, which is affected by the October 2026 Node.js security release (CVE-2026-111497 Brotli OOB write, CVE-2026-106069 TLS hostname bypass, and others). - CI setup-node: 22.12.0 -> 22.23.4 - WebUI build stage: node:22-alpine -> node:22.23.4-alpine - webui engines: >=22.12.0 -> >=22.23.4 --- .github/workflows/ci.yml | 2 +- Dockerfile | 2 +- webui/package-lock.json | 2 +- webui/package.json | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 91db54a..4741fe4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -38,7 +38,7 @@ jobs: cache: true - uses: actions/setup-node@v4 with: - node-version: "22.12.0" + node-version: "22.23.4" cache: npm cache-dependency-path: webui/package-lock.json - run: npm ci diff --git a/Dockerfile b/Dockerfile index 1f60188..6ddf6db 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1.7 -FROM node:22-alpine AS webui-build +FROM node:22.23.4-alpine AS webui-build WORKDIR /src/webui COPY webui/package.json webui/package-lock.json ./ RUN npm ci diff --git a/webui/package-lock.json b/webui/package-lock.json index 93ccc10..d4dc074 100644 --- a/webui/package-lock.json +++ b/webui/package-lock.json @@ -33,7 +33,7 @@ "vue-tsc": "^2.2.12" }, "engines": { - "node": ">=22.12.0" + "node": ">=22.23.4" } }, "node_modules/@asamuzakjp/css-color": { diff --git a/webui/package.json b/webui/package.json index 7b192f5..839ce9a 100644 --- a/webui/package.json +++ b/webui/package.json @@ -4,7 +4,7 @@ "version": "1.0.0", "type": "module", "engines": { - "node": ">=22.12.0" + "node": ">=22.23.4" }, "scripts": { "fonts:generate": "node scripts/generate-fonts.mjs",