Repository navigation
Promote staging: October 2026 CVE patches - #191
Merged
Merged
Conversation
- Pin Railpack Node to 22.23.4 (Oct 21 Node security release: Brotli decoder RCE CVE-2026-111497, TLS hostname bypasses CVE-2026-105483/CVE-2026-106069, dns NUL truncation CVE-2026-105482). Builds were resolving 22.23.2. - Bump the AI gateway image eceasy/cli-proxy-api v7.2.132 -> v8.0.38. v7.2.132 was built with go1.26.6 and missed the Oct 8 net/http fixes and the Oct 21 crypto/x509 CA denylist (CVE-2026-111943); v8.0.38 is built with go1.26.10 and still reads the legacy config layout that entrypoint.sh renders. - Bump next and eslint-config-next 16.3.3 -> 16.3.8 (next/og RCE, Image Optimization SSRF, ISR cache poisoning advisories). - Raise the sharp override 0.35.4 -> 0.35.5 (librsvg CVE-2026-96889) and refresh source-map-js to 1.2.2.
fix(security): patch October 2026 Node, Go and Next.js CVEs
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes #190 (Node 22.23.4, cli-proxy-api v8.0.38 built with go1.26.10, next 16.3.8, sharp 0.35.5) from
stagingtomain. These are the only commits onstagingthat aren't onmain.See #190 for the advisories and verification. CI passed on #190, including browser tests.
Hold merging until the staging deploy is verified on Railway. Railway builds are currently paused because of its Oct 21 security incident.