From 0fb9a50a630e1abc35646564cfc404c9b3bfcd6b Mon Sep 17 00:00:00 2001 From: "heygengenesis[bot]" <262951085+heygengenesis[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 05:41:56 +0000 Subject: [PATCH] fix(docker): Node 22.23.4 and Bun 1.4.4 for CVE-2026-111497 (Brotli) (#6440) Co-Authored-By: Claude Co-authored-by: Joel Gallardo Co-authored-by: heygengenesis[bot] <262951085+heygengenesis[bot]@users.noreply.github.com> --- Dockerfile.test | 4 ++-- packages/cli/src/docker/Dockerfile.render | 2 +- packages/gcp-cloud-run/Dockerfile | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Dockerfile.test b/Dockerfile.test index c81a9f3a8c..4e6cf42d80 100644 --- a/Dockerfile.test +++ b/Dockerfile.test @@ -10,7 +10,7 @@ # docker run --rm -v ./packages/producer/tests:/app/packages/producer/tests hyperframes-producer:test # docker run --rm -v ./packages/producer/tests:/app/packages/producer/tests hyperframes-producer:test --update -FROM node:22.23.3-bookworm-slim +FROM node:22.23.4-bookworm-slim # ── System dependencies (identical to production) ──────────────────────────── RUN apt-get update && apt-get install -y --no-install-recommends \ @@ -88,7 +88,7 @@ RUN npx --yes @puppeteer/browsers install chrome-headless-shell@152.0.7977.30 \ WORKDIR /app # Install bun -RUN curl -fsSL https://bun.sh/install | BUN_INSTALL="/root/.bun" bash -s "bun-v1.3.13" +RUN curl -fsSL https://bun.sh/install | BUN_INSTALL="/root/.bun" bash -s "bun-v1.4.4" ENV PATH="/root/.bun/bin:$PATH" # Install dependencies (full, including devDependencies for tsx + test harness). diff --git a/packages/cli/src/docker/Dockerfile.render b/packages/cli/src/docker/Dockerfile.render index 2ff9f3cb0b..9667dc6f1f 100644 --- a/packages/cli/src/docker/Dockerfile.render +++ b/packages/cli/src/docker/Dockerfile.render @@ -1,4 +1,4 @@ -FROM node:22.23.3-bookworm-slim +FROM node:22.23.4-bookworm-slim ARG HYPERFRAMES_VERSION=latest # Set automatically by `docker build --platform` (BuildKit); selects the diff --git a/packages/gcp-cloud-run/Dockerfile b/packages/gcp-cloud-run/Dockerfile index db92bdbc6c..ec2541392c 100644 --- a/packages/gcp-cloud-run/Dockerfile +++ b/packages/gcp-cloud-run/Dockerfile @@ -21,7 +21,7 @@ # Unlike the AWS Lambda adapter there is no ZIP-size ceiling and no runtime # Chrome decompression step — the binary lives in the image at a fixed path. -FROM node:22.23.3-bookworm-slim AS beginframe-contract +FROM node:22.23.4-bookworm-slim AS beginframe-contract # ── System dependencies (identical set to the producer's render image) ─────── RUN apt-get update && apt-get install -y --no-install-recommends \ @@ -100,7 +100,7 @@ WORKDIR /app # the container runs `bun dist/server.js` and relies on bun's ESM `require` # interop to load the producer bundle, so a future bun release changing that # behaviour shouldn't silently break the next image rebuild. Bump deliberately. -RUN curl -fsSL https://bun.sh/install | bash -s "bun-v1.4.2" +RUN curl -fsSL https://bun.sh/install | bash -s "bun-v1.4.4" ENV PATH="/root/.bun/bin:$PATH" # Install workspace dependencies. Copy manifests first for layer caching.