[Brooooooklyn]

Void's shipped default Sandbox still uses Node 26.10.0, and the GitHub build-agent image uses the floating node:26-slim tag. Upgrade the maintained runtime pins to the fixed versions listed in the October 2026 Node security release for CVE-2026-111497.

• Set .node-version to 24.22.1, which is already consumed by the CI setup and release workflows.
• Upgrade the default Sandbox to node:26.12.1-trixie-slim and pin the build agent to node:26.12.1-slim. Docker Hub manifest inspection confirmed both fixed tags exist, support amd64/arm64, and resolve to the same Debian Trixie image index; the distro is preserved.
• Sync the Sandbox Dockerfile example and build-agent README, including the example's existing SDK helper version with the installed 1.0.2 helper.

Package compatibility ranges, dependency versions and the lockfile are unchanged. Platform CI already uses docker build --pull; there are no additional static cached Node image references to update.

Validation

• vp install --frozen-lockfile: passed, including the core package build.
• Focused Sandbox configuration, packaging, RPC/runtime and build-container tests: 5 files / 315 tests passed under Node 24.22.1.
• vp run test --list: selected all 731 files because .node-version changed; that selection was covered by the full verification below.
• vp run test:all: formatting, lint, all package/playground builds, artifact checks, platform type-aware lint and vp run check passed.
• Both updated Dockerfiles built successfully using --pull --platform linux/amd64. Inspection containers reported Node v26.12.1 and Debian 13 (trixie). The Sandbox helper was executable and a harmless Brotli round trip passed. The build agent retained Corepack 0.35.0, Bun 1.3.14, builder uid 1000 and its packaged agent entry; pnpm 11.8.0 and Yarn 1.22.22 ran offline as the unprivileged builder.
• git diff --check: passed.

The full test suite did not pass: 728 files passed, 2 failed and 1 skipped; 14,262 tests passed, 2 failed and 31 skipped. The overall vp run test:all exit code was 1.

1. platform/packages/api/test/integration/admin-dashboard.test.ts:491: the ResizeObserver sizes array remained empty until expect.poll timed out. The entire file passed on a focused rerun.
2. packages/void/test/integration/astro.test.ts: the initial SSR fetch lost its loopback connection. On the focused rerun, the dev cases passed but the PostgreSQL suite failed in beforeAll at line 297: Astro restarted after dependency optimization/tsconfig reload, and Miniflare/Cloudflare Vite plugin type discovery lost a loopback socket (Server stopped while waiting, other side closed). The same PostgreSQL startup failure was reproduced with the original Node 24.21.0, confirmed with both node --version and vp exec node --version. The fixed 24.22.1 pin was restored afterward. No application or test-source changes were made to hide these failures.

This PR prepares the source fix. Existing published packages and running containers still require their normal release/rebuild/rollout before their runtime exposure is remediated.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T03:31:47.856126Z	3011418	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://fix-node-cve-2026-111497-void-cloud.voidzero-docs.workers.dev (commit 3011418)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://8086a69e-void-cloud.voidzero-docs.workers.dev	3011418	2026-10-22T03:32:07.815Z	Visit the dashboard ↗

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3011418fa9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".