From 3011418fa9b1ad2019c1dbd7858474bb97a760ce Mon Sep 17 00:00:00 2001 From: LongYinan Date: Thu, 22 Oct 2026 11:28:35 +0800 Subject: [PATCH] fix: update Node runtimes for CVE-2026-111497 --- .node-version | 2 +- docs/guide/sandboxes.md | 4 ++-- packages/void/sandbox.Dockerfile | 2 +- platform/packages/api/README.md | 2 +- platform/packages/api/container/Dockerfile | 6 +++--- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.node-version b/.node-version index df6ae3370..ce62013c3 100644 --- a/.node-version +++ b/.node-version @@ -1 +1 @@ -24.21.0 +24.22.1 diff --git a/docs/guide/sandboxes.md b/docs/guide/sandboxes.md index fc8b97ecd..9bb930f8b 100644 --- a/docs/guide/sandboxes.md +++ b/docs/guide/sandboxes.md @@ -120,8 +120,8 @@ See the [configuration reference](../reference/config.md#sandbox) for binding na Custom images must include the helper matching Void's installed Sandbox SDK version. The SDK image supplies this binary, but is not a runnable environment itself: ```dockerfile -FROM node:26.10.0-trixie-slim -COPY --from=docker.io/cloudflare/sandbox:1.0.1 /usr/local/bin/sandbox-shim /usr/local/bin/sandbox-shim +FROM node:26.12.1-trixie-slim +COPY --from=docker.io/cloudflare/sandbox:1.0.2 /usr/local/bin/sandbox-shim /usr/local/bin/sandbox-shim WORKDIR /workspace CMD ["sleep", "infinity"] ``` diff --git a/packages/void/sandbox.Dockerfile b/packages/void/sandbox.Dockerfile index 396a41489..01cdbcbf7 100644 --- a/packages/void/sandbox.Dockerfile +++ b/packages/void/sandbox.Dockerfile @@ -1,4 +1,4 @@ -FROM node:26.10.0-trixie-slim +FROM node:26.12.1-trixie-slim COPY --from=docker.io/cloudflare/sandbox:1.0.2 /usr/local/bin/sandbox-shim /usr/local/bin/sandbox-shim WORKDIR /workspace CMD ["sleep", "infinity"] diff --git a/platform/packages/api/README.md b/platform/packages/api/README.md index 50b203a9d..edaaa6452 100644 --- a/platform/packages/api/README.md +++ b/platform/packages/api/README.md @@ -69,7 +69,7 @@ src/ routes/ # Admin page shells, audited form actions, and log polling middleware/auth.ts # Admin cookie auth + same-origin guard on every write container/ - Dockerfile # node:26-slim + pinned corepack + bun build image + Dockerfile # node:26.12.1-slim + pinned corepack + bun build image build-agent.mjs # Downloads source tarball, installs deps, runs `npx void deploy` drizzle/ 0000_*.sql diff --git a/platform/packages/api/container/Dockerfile b/platform/packages/api/container/Dockerfile index 130f05388..fbeb99376 100644 --- a/platform/packages/api/container/Dockerfile +++ b/platform/packages/api/container/Dockerfile @@ -9,9 +9,9 @@ # Env vars injected by the DO at start(): # BUILD_ID, PROJECT_ID, PROJECT_SLUG, SOURCE_TARBALL_URL, SOURCE_TOKEN, # VOID_TOKEN, VOID_API_URL, VOID_PROJECT, DO_LOG_URL, AGENT_TOKEN -FROM node:26-slim +FROM node:26.12.1-slim -# node:26-slim ships `tar` + `gzip` but is otherwise minimal. We add: +# node:26.12.1-slim ships `tar` + `gzip` but is otherwise minimal. We add: # ca-certificates HTTPS for the tarball fetch, npm/bun installs, deploy upload # curl documented fallback download path + the bun install script # unzip required by the bun install script @@ -59,7 +59,7 @@ RUN curl -fsSL https://bun.sh/install | bash -s "bun-v${BUN_VERSION}" \ # unprivileged install has somewhere writable — build-agent.mjs points the child's # cache env vars (builderCacheEnv) at these paths. /tmp/build is the agent's # WORK_DIR parent; chowning it lets the builder own the extracted tree. -# node:26-slim ships a built-in `node` user that already owns uid/gid 1000, so +# node:26.12.1-slim ships a built-in `node` user that already owns uid/gid 1000, so # it must be removed first or the useradd fails with "UID 1000 is not unique" # and the image cannot build. Nothing here runs as `node`. RUN userdel node \