Repository navigation
ci: resolve the newest Node 24.x instead of the runner's cached one - #48
Merged
Merged
Conversation
setup-node with a bare major takes whatever 24.x the runner image has in its toolcache. On ubuntu-latest that is still 24.21.0, so CI kept running on a Node without the CVE-2026-111497 (Node2Shell) Brotli fix that 24.22.1 shipped. check-latest makes it resolve against actions/node-versions on every run; node-version stays at 24 so the Renovate regex still matches. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CI was building and testing on a Node without the Node2Shell fix (CVE-2026-111497, Brotli decoder out-of-bounds write, fixed in 24.22.1).
setup-nodewith a bare24takes whatever 24.x the runner image has cached, and ubuntu-latest still ships 24.21.0.- uses: actions/setup-node@v7 with: node-version: 24 + check-latest: true # resolve against actions/node-versions on every run cache: pnpmApplied to all three
setup-nodesteps (fmt-and-lint,unit-web,e2e).node-versionstays24, so the Renovatenode-versionregex manager still matches.Context: the shipped image is not affected. Runtime is
FROM scratchwith the Rust binary (no Node), and the only Brotli in it is the pure-Rustbrotlicrate, used bytower-httpto compress responses, never to decode untrusted input. The Dockerweb-builderstage'snode:24-alpinealready resolves to 24.22.1. This PR covers CI only.Evidence
vitestandfmt + clippy + tsc):Found in cache @ /opt/hostedtoolcache/node/24.21.0/x64After (run 40070550168,
vitest, passed):Attempting to download 24.22.1...Acquiring 24.22.1 - x64 from https://github.com/actions/node-versions/releases/download/24.22.1-39619001896/node-24.22.1-linux-x64.tar.gzcargo-denyfails on RUSTSEC-2026-0386/0387. That is unrelated to this PR: both advisories were published aftermain's last CI run (wherecargo-denypassed), so any branch cut frommainnow hits them. #47 addresses them.Merge Danger
Door: two-way
Revert the one line per job.
Blast Radius: CI-only
Each Node job now downloads Node (~seconds) when the toolcache is behind, and a new 24.x patch reaches CI the day it ships, without a Renovate PR.
🤖 Generated with Claude Code