Repository navigation
Releases
26.13.0-dev-20261110.160
ghcr.io/pair-ai-platform/node:26.13.0-dev-20261110.160
Node.js 26.13.0 (dev). Index digest sha256:02df01aea1d25039ffb7f83396d2c6b6ffd93e5b89da5b943d58beadbd2d554d.
Tags: 26.13.0-dev-20261110.160, 26-dev, 26.13-dev, 26.13.0-dev, latest-dev.
What changed
| Package | From | To |
|---|---|---|
glibc-2.44 |
2.44-r15 | 2.44-r16 |
glibc-2.44-dev |
2.44-r15 | 2.44-r16 |
glibc-2.44-locale-posix |
2.44-r15 | 2.44-r16 |
ld-linux-2.44 |
2.44-r15 | 2.44-r16 |
libcrypt1-2.44 |
2.44-r15 | 2.44-r16 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 277.1 MB | 745.2 MB |
| aarch64 | 79 | 261.4 MB | 795.5 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r16, glibc-2.44-dev 2.44-r16, libicu79 79.1-r2, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, libuv 1.53.0-r0, nodejs-26 26.13.0-r1, npm-12 12.2.2-r0, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, pnpm-11.8 11.8.0-r5, yarn 1.22.22-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-101043 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82392 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82393 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r16 | glibc-2.44 2.44-r16 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| GHSA-3g3m-2fjr-6pw4 | Medium | glob |
13.0.6 | npm-12 12.2.2-r0 |
14.0.2 | x86_64, aarch64 |
| GHSA-g3hv-75wg-m249 | Medium | minimatch |
10.2.3 | npm-12 12.2.2-r0 |
11.0.1 | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:26.13.0-dev-20261110.160 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:26.13.0-dev-20261110.160 --repo Pair-AI-Platform/node26.13.0-dev-20261110.157
ghcr.io/pair-ai-platform/node:26.13.0-dev-20261110.157
Node.js 26.13.0 (dev). Index digest sha256:e9eeb190e237c6e48e16f363e58c06fe817c52fa8db9ff86f9792ca15bc606de.
Tags: 26.13.0-dev-20261110.157, 26-dev, 26.13-dev, 26.13.0-dev, latest-dev.
What changed
| Package | From | To |
|---|---|---|
binutils |
2.47-r3 | 2.47-r4 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 277.1 MB | 745.2 MB |
| aarch64 | 79 | 261.5 MB | 795.5 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r15, glibc-2.44-dev 2.44-r15, libicu79 79.1-r2, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, libuv 1.53.0-r0, nodejs-26 26.13.0-r1, npm-12 12.2.2-r0, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, pnpm-11.8 11.8.0-r5, yarn 1.22.22-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-101043 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82392 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82393 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r15 | glibc-2.44 2.44-r15 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| GHSA-3g3m-2fjr-6pw4 | Medium | glob |
13.0.6 | npm-12 12.2.2-r0 |
14.0.2 | x86_64, aarch64 |
| GHSA-g3hv-75wg-m249 | Medium | minimatch |
10.2.3 | npm-12 12.2.2-r0 |
11.0.1 | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:26.13.0-dev-20261110.157 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:26.13.0-dev-20261110.157 --repo Pair-AI-Platform/node26.13.0-dev-20261109.150
ghcr.io/pair-ai-platform/node:26.13.0-dev-20261109.150
Node.js 26.13.0 (dev). Index digest sha256:5eb2cfec24b91b3f7b995201c76ca4e49851db7b2734b139d73a1315fa8dd7aa.
Tags: 26.13.0-dev-20261109.150, 26-dev, 26.13-dev, 26.13.0-dev, latest-dev.
What changed
| Package | From | To |
|---|---|---|
glibc-2.44 |
2.44-r14 | 2.44-r15 |
glibc-2.44-dev |
2.44-r14 | 2.44-r15 |
glibc-2.44-locale-posix |
2.44-r14 | 2.44-r15 |
icu79-data-full |
79.1-r1 | 79.1-r2 |
ld-linux-2.44 |
2.44-r14 | 2.44-r15 |
libcrypt1-2.44 |
2.44-r14 | 2.44-r15 |
libicu79 |
79.1-r1 | 79.1-r2 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 277.1 MB | 745.2 MB |
| aarch64 | 79 | 261.5 MB | 795.5 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r15, glibc-2.44-dev 2.44-r15, libicu79 79.1-r2, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, libuv 1.53.0-r0, nodejs-26 26.13.0-r1, npm-12 12.2.2-r0, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, pnpm-11.8 11.8.0-r5, yarn 1.22.22-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-101043 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82392 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82393 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r15 | glibc-2.44 2.44-r15 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| GHSA-3g3m-2fjr-6pw4 | Medium | glob |
13.0.6 | npm-12 12.2.2-r0 |
14.0.2 | x86_64, aarch64 |
| GHSA-g3hv-75wg-m249 | Medium | minimatch |
10.2.3 | npm-12 12.2.2-r0 |
11.0.1 | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:26.13.0-dev-20261109.150 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:26.13.0-dev-20261109.150 --repo Pair-AI-Platform/node26.13.0-dev-20261109.147
ghcr.io/pair-ai-platform/node:26.13.0-dev-20261109.147
Node.js 26.13.0 (dev). Index digest sha256:276025ca4b1a77199795b4fe47a027129b0d29abed8e50e3d0f5540f5c9313cf.
Tags: 26.13.0-dev-20261109.147, 26-dev, 26.13-dev, 26.13.0-dev, latest-dev.
What changed
| Package | From | To |
|---|---|---|
binutils |
2.47-r2 | 2.47-r3 |
gcc |
16.2.0-r2 | 16.2.0-r3 |
libatomic |
16.2.0-r2 | 16.2.0-r3 |
libgcc |
16.2.0-r2 | 16.2.0-r3 |
libgomp |
16.2.0-r2 | 16.2.0-r3 |
libquadmath |
16.2.0-r2 | 16.2.0-r3 |
libstdc++ |
16.2.0-r2 | 16.2.0-r3 |
libstdc++-dev |
16.2.0-r2 | 16.2.0-r3 |
openssf-compiler-options |
20250904-r11 | 20250904-r12 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 277.1 MB | 745.2 MB |
| aarch64 | 79 | 261.5 MB | 795.5 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r14, glibc-2.44-dev 2.44-r14, libicu79 79.1-r1, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, libuv 1.53.0-r0, nodejs-26 26.13.0-r1, npm-12 12.2.2-r0, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, pnpm-11.8 11.8.0-r5, yarn 1.22.22-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-101043 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82392 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82393 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r14 | glibc-2.44 2.44-r14 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| GHSA-3g3m-2fjr-6pw4 | Medium | glob |
13.0.6 | npm-12 12.2.2-r0 |
14.0.2 | x86_64, aarch64 |
| GHSA-g3hv-75wg-m249 | Medium | minimatch |
10.2.3 | npm-12 12.2.2-r0 |
11.0.1 | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:26.13.0-dev-20261109.147 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:26.13.0-dev-20261109.147 --repo Pair-AI-Platform/node26.13.0-20261110.160
ghcr.io/pair-ai-platform/node:26.13.0-20261110.160
Node.js 26.13.0 (runtime). Index digest sha256:5f7dbfcee405a93f20c10828ed4c1c3fdeda5766a13ff10edc99ed949e55cd94.
Tags: 26.13.0-20261110.160, 26, 26.13, 26.13.0, latest.
What changed
| Package | From | To |
|---|---|---|
glibc-2.44 |
2.44-r15 | 2.44-r16 |
glibc-2.44-locale-posix |
2.44-r15 | 2.44-r16 |
ld-linux-2.44 |
2.44-r15 | 2.44-r16 |
libcrypt1-2.44 |
2.44-r15 | 2.44-r16 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 27 | 59.2 MB | 156.6 MB |
| aarch64 | 27 | 56.7 MB | 154.2 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r16, libicu79 79.1-r2, libstdc++ 16.2.0-r3, libuv 1.53.0-r0, nodejs-26 26.13.0-r1, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 1 / 0 / 0 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 1 / 0 / 0 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r16 | glibc-2.44 2.44-r16 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:26.13.0-20261110.160 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:26.13.0-20261110.160 --repo Pair-AI-Platform/node26.13.0-20261109.150
ghcr.io/pair-ai-platform/node:26.13.0-20261109.150
Node.js 26.13.0 (runtime). Index digest sha256:f49ab6ddb39986996f908b93df9b7e8a36e02156f6d5a8142b25f0c0c5f8cdcd.
Tags: 26.13.0-20261109.150, 26, 26.13, 26.13.0, latest.
What changed
| Package | From | To |
|---|---|---|
glibc-2.44 |
2.44-r14 | 2.44-r15 |
glibc-2.44-locale-posix |
2.44-r14 | 2.44-r15 |
icu79-data-full |
79.1-r1 | 79.1-r2 |
ld-linux-2.44 |
2.44-r14 | 2.44-r15 |
libcrypt1-2.44 |
2.44-r14 | 2.44-r15 |
libicu79 |
79.1-r1 | 79.1-r2 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 27 | 59.2 MB | 156.6 MB |
| aarch64 | 27 | 56.7 MB | 154.2 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r15, libicu79 79.1-r2, libstdc++ 16.2.0-r3, libuv 1.53.0-r0, nodejs-26 26.13.0-r1, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 1 / 0 / 0 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 1 / 0 / 0 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r15 | glibc-2.44 2.44-r15 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:26.13.0-20261109.150 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:26.13.0-20261109.150 --repo Pair-AI-Platform/node26.13.0-20261109.147
ghcr.io/pair-ai-platform/node:26.13.0-20261109.147
Node.js 26.13.0 (runtime). Index digest sha256:5f77e6b134bff56eb3a0254a1f64aa1406e227bfa26e208f691e457c80fa650e.
Tags: 26.13.0-20261109.147, 26, 26.13, 26.13.0, latest.
What changed
| Package | From | To |
|---|---|---|
libgcc |
16.2.0-r2 | 16.2.0-r3 |
libstdc++ |
16.2.0-r2 | 16.2.0-r3 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 27 | 59.2 MB | 156.6 MB |
| aarch64 | 27 | 56.7 MB | 154.2 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r14, libicu79 79.1-r1, libstdc++ 16.2.0-r3, libuv 1.53.0-r0, nodejs-26 26.13.0-r1, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 1 / 0 / 0 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 1 / 0 / 0 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r14 | glibc-2.44 2.44-r14 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:26.13.0-20261109.147 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:26.13.0-20261109.147 --repo Pair-AI-Platform/node24.22.2-dev-20261110.160
ghcr.io/pair-ai-platform/node:24.22.2-dev-20261110.160
Node.js 24.22.2 (dev). Index digest sha256:125cd8b3a9aab03b2330239d8336ff9c2da95d82f265082af96a6612b047815c.
Tags: 24.22.2-dev-20261110.160, 24-dev, 24.22-dev, 24.22.2-dev.
What changed
| Package | From | To |
|---|---|---|
glibc-2.44 |
2.44-r15 | 2.44-r16 |
glibc-2.44-dev |
2.44-r15 | 2.44-r16 |
glibc-2.44-locale-posix |
2.44-r15 | 2.44-r16 |
ld-linux-2.44 |
2.44-r15 | 2.44-r16 |
libcrypt1-2.44 |
2.44-r15 | 2.44-r16 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 273.6 MB | 735.5 MB |
| aarch64 | 79 | 257.7 MB | 783.3 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r16, glibc-2.44-dev 2.44-r16, libicu79 79.1-r2, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, libuv 1.53.0-r0, nodejs-24 24.22.2-r2, npm-12 12.2.2-r0, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, pnpm-11.8 11.8.0-r5, yarn 1.22.22-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-101043 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82392 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82393 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r16 | glibc-2.44 2.44-r16 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| GHSA-3g3m-2fjr-6pw4 | Medium | glob |
13.0.6 | npm-12 12.2.2-r0 |
14.0.2 | x86_64, aarch64 |
| GHSA-g3hv-75wg-m249 | Medium | minimatch |
10.2.3 | npm-12 12.2.2-r0 |
11.0.1 | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:24.22.2-dev-20261110.160 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:24.22.2-dev-20261110.160 --repo Pair-AI-Platform/node24.22.2-dev-20261110.157
ghcr.io/pair-ai-platform/node:24.22.2-dev-20261110.157
Node.js 24.22.2 (dev). Index digest sha256:95ba55a84dc5f9f5f028af8cd846d2681492afa774cc2f7d9cf0f384797beaa8.
Tags: 24.22.2-dev-20261110.157, 24-dev, 24.22-dev, 24.22.2-dev.
What changed
| Package | From | To |
|---|---|---|
binutils |
2.47-r3 | 2.47-r4 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 273.6 MB | 735.5 MB |
| aarch64 | 79 | 257.7 MB | 783.3 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r15, glibc-2.44-dev 2.44-r15, libicu79 79.1-r2, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, libuv 1.53.0-r0, nodejs-24 24.22.2-r2, npm-12 12.2.2-r0, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, pnpm-11.8 11.8.0-r5, yarn 1.22.22-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-101043 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82392 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82393 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r15 | glibc-2.44 2.44-r15 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| GHSA-3g3m-2fjr-6pw4 | Medium | glob |
13.0.6 | npm-12 12.2.2-r0 |
14.0.2 | x86_64, aarch64 |
| GHSA-g3hv-75wg-m249 | Medium | minimatch |
10.2.3 | npm-12 12.2.2-r0 |
11.0.1 | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:24.22.2-dev-20261110.157 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:24.22.2-dev-20261110.157 --repo Pair-AI-Platform/node24.22.2-dev-20261109.150
ghcr.io/pair-ai-platform/node:24.22.2-dev-20261109.150
Node.js 24.22.2 (dev). Index digest sha256:ae840d8538845fe3fcbfe5d96f17353dda53ee3e2d5e15cce67dddf5a94cdb64.
Tags: 24.22.2-dev-20261109.150, 24-dev, 24.22-dev, 24.22.2-dev.
What changed
| Package | From | To |
|---|---|---|
glibc-2.44 |
2.44-r14 | 2.44-r15 |
glibc-2.44-dev |
2.44-r14 | 2.44-r15 |
glibc-2.44-locale-posix |
2.44-r14 | 2.44-r15 |
icu79-data-full |
79.1-r1 | 79.1-r2 |
ld-linux-2.44 |
2.44-r14 | 2.44-r15 |
libcrypt1-2.44 |
2.44-r14 | 2.44-r15 |
libicu79 |
79.1-r1 | 79.1-r2 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 273.6 MB | 735.5 MB |
| aarch64 | 79 | 257.7 MB | 783.3 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r15, glibc-2.44-dev 2.44-r15, libicu79 79.1-r2, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, libuv 1.53.0-r0, nodejs-24 24.22.2-r2, npm-12 12.2.2-r0, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, pnpm-11.8 11.8.0-r5, yarn 1.22.22-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-101043 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82392 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82393 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r15 | glibc-2.44 2.44-r15 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| GHSA-3g3m-2fjr-6pw4 | Medium | glob |
13.0.6 | npm-12 12.2.2-r0 |
14.0.2 | x86_64, aarch64 |
| GHSA-g3hv-75wg-m249 | Medium | minimatch |
10.2.3 | npm-12 12.2.2-r0 |
11.0.1 | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:24.22.2-dev-20261109.150 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:24.22.2-dev-20261109.150 --repo Pair-AI-Platform/node