46 lines
2.6 KiB
Markdown
46 lines
2.6 KiB
Markdown
# Q284 / #470 — patched Node worker base
|
|
|
|
The worker base is Node24.22.2 Bookworm slim, pinned to the official Docker
|
|
Library Node multi-platform index digest. The previous mutable Node24 tag
|
|
could resolve to, or reuse a cached copy of, an older vulnerable release.
|
|
|
|
The Node project identifies the October2026 Brotli decoder memory corruption
|
|
as CVE-2026-111497, fixed in24.22.1. Version24.22.2 was released on2026-10-28.
|
|
Primary release/advisory sources:
|
|
|
|
- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
|
|
- https://nodejs.org/en/blog/release/v24.22.2
|
|
|
|
`index.json` is the exact official registry response read2026-10-29T03:30:27Z.
|
|
Its SHA256 equals the registry Docker-Content-Digest and the Containerfile pin.
|
|
The included Linux amd64 manifest is selected by its platform and independently
|
|
matches its own digest. `RECEIPT.json` gives both identities plus config/layers.
|
|
Only registry metadata was fetched: no layer pull, image build, binary, test,
|
|
container, native or privileged operation was performed for this source change.
|
|
|
|
This does not establish an installed/deployed version, binary provenance beyond
|
|
the selected official registry asset, a full-CI result, or a completed #470
|
|
image rebuild. The retained #470 runtime measurements name other deployed
|
|
api/orchestrator/web images; no binding from those images to this worker was
|
|
observed. Each existing deployment still needs its repository's authorized CI,
|
|
current runtime readbacks and separate operating approval.
|
|
|
|
The apt inputs and tag-only production activation receipts remain #714.
|
|
The Pi/Undici dependency correction remains #713. This base pin does not replace
|
|
either fix or modify any frozen #660/#678/#683 evidence.
|
|
|
|
Independent-review follow-up: `linux-amd64-config.json` is the exact 6,707-byte
|
|
registry config blob selected by the saved manifest. Its SHA256 is
|
|
`9564952982df837e05d23c77e319715650fafc77b1abce39a504b920fda46a44`, and its
|
|
image environment declares `NODE_VERSION=24.22.2`. `CONFIG-RECEIPT.json` records
|
|
the later public metadata read and corrects the earlier receipt's imprecise
|
|
"manifest/config reads" wording; the earlier receipt itself is preserved.
|
|
This is a declared config/version binding, not execution of `node --version`.
|
|
|
|
The image-preparation helper now records the one digest-pinned Containerfile
|
|
FROM reference directly. A well-formed receipt naming a stale mutable-tag image
|
|
refuses before image inspection. The helper does not inspect an unrelated local
|
|
base tag. Frozen #660 packets and running H1 inputs are unchanged; this is only
|
|
a future source candidate. The dedicated runner must admit and validate the
|
|
exact joined candidate before any merge or image use.
|