From 70499dd65f64c84c5d3aefcc76517e788404bd79 Mon Sep 17 00:00:00 2001 From: Sy Bohy Date: Fri, 23 Oct 2026 21:44:31 -0700 Subject: [PATCH 1/4] fix: pin patched Node for development and CI --- .devcontainer/Dockerfile | 9 +++++++-- .devcontainer/devcontainer.json | 2 +- .github/actions/setup/action.yml | 2 +- .github/workflows/_build.yml | 2 +- .github/workflows/check.yml | 16 ++++++++-------- .nvmrc | 1 + package.json | 2 +- 7 files changed, 20 insertions(+), 14 deletions(-) create mode 100644 .nvmrc diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index b976a33..50269f9 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -1,6 +1,11 @@ -ARG VARIANT="24" +ARG VARIANT="24-bookworm" -FROM mcr.microsoft.com/vscode/devcontainers/javascript-node:${VARIANT} +FROM mcr.microsoft.com/devcontainers/javascript-node:1-${VARIANT} + +# Refresh the bundled Node binary; a supported-major image can contain an older patch. +USER root +RUN su node -c "source /usr/local/share/nvm/nvm.sh && nvm install 24.22.1 && nvm alias default 24.22.1" +ENV PATH="/usr/local/share/nvm/versions/node/v24.22.1/bin:${PATH}" USER node WORKDIR /home/node diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 5193173..36809a9 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -3,7 +3,7 @@ "build": { "dockerfile": "Dockerfile", "args": { - "VARIANT": "24" + "VARIANT": "24-bookworm" } }, "extensions": [ diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml index fb7b25d..c91225c 100644 --- a/.github/actions/setup/action.yml +++ b/.github/actions/setup/action.yml @@ -6,7 +6,7 @@ inputs: node_version: description: The Node.js version. required: false - default: '24' + default: '24.22.1' registry_url: description: The Node.js package registry URL. required: false diff --git a/.github/workflows/_build.yml b/.github/workflows/_build.yml index e93d4d7..24cf98a 100644 --- a/.github/workflows/_build.yml +++ b/.github/workflows/_build.yml @@ -8,7 +8,7 @@ on: description: The Node.js version. type: string required: false - default: '24' + default: '24.22.1' outputs: artifact_name: description: The artifact name. diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 8606ae7..5d23829 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -20,8 +20,8 @@ jobs: os: - ubuntu-latest node: - - '22' - - '24' + - '22.23.4' + - '24.22.1' include: - os: ubuntu-latest os_name: Linux @@ -42,8 +42,8 @@ jobs: fail-fast: false matrix: node: - - '22' - - '24' + - '22.23.4' + - '24.22.1' steps: - name: Checkout uses: actions/checkout@v7 @@ -67,8 +67,8 @@ jobs: os: - ubuntu-latest node: - - '22' - - '24' + - '22.23.4' + - '24.22.1' include: - os: ubuntu-latest os_name: Linux @@ -113,8 +113,8 @@ jobs: fail-fast: false matrix: node: - - '22' - - '24' + - '22.23.4' + - '24.22.1' steps: - name: Checkout uses: actions/checkout@v7 diff --git a/.nvmrc b/.nvmrc new file mode 100644 index 0000000..ce62013 --- /dev/null +++ b/.nvmrc @@ -0,0 +1 @@ +24.22.1 diff --git a/package.json b/package.json index 41354a4..7242ae3 100644 --- a/package.json +++ b/package.json @@ -66,7 +66,7 @@ "devEngines": { "runtime": { "name": "node", - "version": "^24.11.0 || ^22.12.0" + "version": "^24.22.1 || ^22.23.4" }, "packageManager": { "name": "npm", From 24e8a40683a382e743c21b0abcd8ab201e3b8730 Mon Sep 17 00:00:00 2001 From: Sy Bohy Date: Fri, 23 Oct 2026 21:49:41 -0700 Subject: [PATCH 2/4] fix: use available Node 24 devcontainer base and Bash --- .devcontainer/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 50269f9..294d53f 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -1,10 +1,10 @@ ARG VARIANT="24-bookworm" -FROM mcr.microsoft.com/devcontainers/javascript-node:1-${VARIANT} +FROM mcr.microsoft.com/devcontainers/javascript-node:5-${VARIANT} # Refresh the bundled Node binary; a supported-major image can contain an older patch. USER root -RUN su node -c "source /usr/local/share/nvm/nvm.sh && nvm install 24.22.1 && nvm alias default 24.22.1" +RUN su -s /bin/bash node -c "source /usr/local/share/nvm/nvm.sh && nvm install 24.22.1 && nvm alias default 24.22.1" ENV PATH="/usr/local/share/nvm/versions/node/v24.22.1/bin:${PATH}" USER node From 6652f98c81e7487898fe4513a492b82427e40078 Mon Sep 17 00:00:00 2001 From: Sy Bohy Date: Fri, 23 Oct 2026 21:55:35 -0700 Subject: [PATCH 3/4] fix(ci): keep required check names stable across Node patches --- .github/workflows/check.yml | 42 ++++++++++++++++++++++++++----------- 1 file changed, 30 insertions(+), 12 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 5d23829..1a340e2 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -20,18 +20,22 @@ jobs: os: - ubuntu-latest node: - - '22.23.4' - - '24.22.1' + - '22' + - '24' include: - os: ubuntu-latest os_name: Linux + - node: '22' + node_version: '22.23.4' + - node: '24' + node_version: '24.22.1' steps: - name: Checkout uses: actions/checkout@v7 - name: Setup uses: ./.github/actions/setup with: - node_version: ${{ matrix.node }} + node_version: ${{ matrix.node_version }} - name: Test run: npm test lint: @@ -42,15 +46,20 @@ jobs: fail-fast: false matrix: node: - - '22.23.4' - - '24.22.1' + - '22' + - '24' + include: + - node: '22' + node_version: '22.23.4' + - node: '24' + node_version: '24.22.1' steps: - name: Checkout uses: actions/checkout@v7 - name: Setup uses: ./.github/actions/setup with: - node_version: ${{ matrix.node }} + node_version: ${{ matrix.node_version }} - name: Lint run: npm run lint build: @@ -67,16 +76,20 @@ jobs: os: - ubuntu-latest node: - - '22.23.4' - - '24.22.1' + - '22' + - '24' include: - os: ubuntu-latest os_name: Linux + - node: '22' + node_version: '22.23.4' + - node: '24' + node_version: '24.22.1' steps: - name: Setup Node.js uses: actions/setup-node@v7 with: - node-version: ${{ matrix.node }} + node-version: ${{ matrix.node_version }} - name: Download artifact uses: actions/download-artifact@v8 with: @@ -113,15 +126,20 @@ jobs: fail-fast: false matrix: node: - - '22.23.4' - - '24.22.1' + - '22' + - '24' + include: + - node: '22' + node_version: '22.23.4' + - node: '24' + node_version: '24.22.1' steps: - name: Checkout uses: actions/checkout@v7 - name: Setup uses: ./.github/actions/setup with: - node_version: ${{ matrix.node }} + node_version: ${{ matrix.node_version }} - name: Typecheck run: npm run typecheck docs: From 41a1c2afd1f59b49e61841455724eae01b9f2d71 Mon Sep 17 00:00:00 2001 From: Sy Bohy Date: Fri, 23 Oct 2026 22:05:43 -0700 Subject: [PATCH 4/4] fix(security): replace inherited devcontainer Node binaries --- .devcontainer/Dockerfile | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 294d53f..e481637 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -1,11 +1,20 @@ ARG VARIANT="24-bookworm" +FROM node:24.22.1-bookworm-slim@sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205 AS patched-node + FROM mcr.microsoft.com/devcontainers/javascript-node:5-${VARIANT} -# Refresh the bundled Node binary; a supported-major image can contain an older patch. -USER root -RUN su -s /bin/bash node -c "source /usr/local/share/nvm/nvm.sh && nvm install 24.22.1 && nvm alias default 24.22.1" -ENV PATH="/usr/local/share/nvm/versions/node/v24.22.1/bin:${PATH}" +# Patch the system binary and every inherited nvm copy used by interactive shells. +COPY --from=patched-node /usr/local/bin/node /tmp/patched-node +RUN install -m 0755 /tmp/patched-node /usr/local/bin/node \ + && if [ -d /usr/local/share/nvm/versions/node ]; then \ + find /usr/local/share/nvm/versions/node -type f -path "*/bin/node" \ + -exec install -m 0755 /tmp/patched-node {} \; ; \ + fi \ + && rm /tmp/patched-node \ + && test "$(node --version)" = "v24.22.1" \ + && test "$(/usr/local/bin/node --version)" = "v24.22.1" +ENV NODE_VERSION=24.22.1 USER node WORKDIR /home/node