From b055d598391f7a66935454be9f2d8ceb6c0e4a77 Mon Sep 17 00:00:00 2001 From: Sy Bohy Date: Fri, 23 Oct 2026 22:07:15 -0700 Subject: [PATCH 1/2] chore(security): patch inherited Node 24 devcontainer binaries --- .devcontainer/Dockerfile | 18 ++++++++++++++++-- .devcontainer/devcontainer.json | 2 +- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 2b22a95c..7233c42c 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -1,6 +1,20 @@ -ARG VARIANT="24" +ARG VARIANT="24-bookworm" -FROM mcr.microsoft.com/vscode/devcontainers/javascript-node:${VARIANT} +FROM node:24.22.1-bookworm-slim@sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205 AS patched-node + +FROM mcr.microsoft.com/devcontainers/javascript-node:${VARIANT} + +# Patch the system binary and every inherited nvm copy used by interactive shells. +COPY --from=patched-node /usr/local/bin/node /tmp/patched-node +RUN install -m 0755 /tmp/patched-node /usr/local/bin/node \ + && if [ -d /usr/local/share/nvm/versions/node ]; then \ + find /usr/local/share/nvm/versions/node -type f -path "*/bin/node" \ + -exec install -m 0755 /tmp/patched-node {} \; ; \ + fi \ + && rm /tmp/patched-node \ + && test "$(node --version)" = "v24.22.1" \ + && test "$(/usr/local/bin/node --version)" = "v24.22.1" +ENV NODE_VERSION=24.22.1 USER node WORKDIR /home/node diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index db2e75dd..f62f2a57 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -3,7 +3,7 @@ "build": { "dockerfile": "Dockerfile", "args": { - "VARIANT": "24" + "VARIANT": "24-bookworm" } }, "extensions": [ From b45d57830ead3ca3883c27311fdbeacee0b9b4b6 Mon Sep 17 00:00:00 2001 From: Sy Bohy Date: Fri, 23 Oct 2026 22:12:36 -0700 Subject: [PATCH 2/2] chore(security): resolve current Node patch before cached binaries --- .github/actions/setup-node/action.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/actions/setup-node/action.yml b/.github/actions/setup-node/action.yml index d52103d3..b32a6888 100644 --- a/.github/actions/setup-node/action.yml +++ b/.github/actions/setup-node/action.yml @@ -24,12 +24,14 @@ runs: if: inputs.install_dependencies == 'true' with: node-version: ${{ inputs.node_version }} + check-latest: true registry-url: ${{ inputs.registry_url }} - name: Setup Node.js without cache uses: actions/setup-node@v7 if: inputs.install_dependencies == 'false' with: node-version: ${{ inputs.node_version }} + check-latest: true registry-url: ${{ inputs.registry_url }} - name: Install dependencies if: inputs.install_dependencies == 'true'