Repository navigation
fix(security): patch October 2026 Node, Go and Next.js CVEs - #190
Merged
Merged
Conversation
- Pin Railpack Node to 22.23.4 (Oct 21 Node security release: Brotli decoder RCE CVE-2026-111497, TLS hostname bypasses CVE-2026-105483/CVE-2026-106069, dns NUL truncation CVE-2026-105482). Builds were resolving 22.23.2. - Bump the AI gateway image eceasy/cli-proxy-api v7.2.132 -> v8.0.38. v7.2.132 was built with go1.26.6 and missed the Oct 8 net/http fixes and the Oct 21 crypto/x509 CA denylist (CVE-2026-111943); v8.0.38 is built with go1.26.10 and still reads the legacy config layout that entrypoint.sh renders. - Bump next and eslint-config-next 16.3.3 -> 16.3.8 (next/og RCE, Image Optimization SSRF, ISR cache poisoning advisories). - Raise the sharp override 0.35.4 -> 0.35.5 (librsvg CVE-2026-96889) and refresh source-map-js to 1.2.2.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Security releases from the last few days affect services running in this project on Railway:
@macro-tracker/web, backend (Railpack)infra/cliproxyapi)cli-proxy-api:v7.2.132(go1.26.6)v8.0.38(go1.26.10)@macro-tracker/web@macro-tracker/web(transitive)railpack.jsonis in the web and backendwatchPatterns, so this rebuilds both services.Notes on the gateway major bump
v8 restructured its config, but it still reads the legacy flat layout that
entrypoint.shgenerates (see the compatibility notes in the v8config.example.yaml). There are no newer v7 builds: the v7 line stopped at v7.3.20 on Sep 27, built with go1.26.8.--codex-loginstill exists, so the README fallback is still valid.Verification
infra/cliproxyapiimage locally and ran it with the real entrypoint./v1/modelsreturns 200 with the API key and 401 without it,/v0/management/configreturns 200 with the management key and 401 without it,/management.htmlreturns 200, and startup logs show v8.0.38 with no errors.go version -mon the image binaries: v7.2.132 = go1.26.6, v8.0.38 = go1.26.10.pnpm audit --prod: no known vulnerabilities (previously 3 critical, 6 high).typecheck,lintandbuildpass.testpasses everything except the integration suites that need a backend on :4000 orTEST_DATABASE_URL(api-v1, api-token-actions, api-settings-client, meal-entry-copy). Those aren't available locally; CI covers them.