Repository navigation
fix(arm): bump armv7l NODE22_VERSION to 22.23.4 (Oct 2026 security release) - #264
Merged
Merged
Conversation
Our fork adds a standalone NODE22_VERSION pin (used only for the linux-arm/armv7l node22 fallback) that upstream does not maintain or bump on our behalf. It was pinned at 22.22.3 (2026-05-13), which predates the Node.js October 21, 2026 security release and is missing fixes for: - CVE-2026-106069/106072 (TLS non-canonical IP hostname bypass, High) - CVE-2026-105482 (dns.resolve* NUL-byte truncation, High) - CVE-2026-111497 (Brotli decoder OOB write / RCE, High) - CVE-2026-105481 (HTTP keep-alive response confusion, Medium) - CVE-2026-106074 (crypto RNG snapshot-cache reuse, Medium) - CVE-2026-106073 (permission model fs.realpathSync bypass, Low) Bumps to 22.23.4, the actual fixed LTS release. Verified the linux-armv7l tarball exists at this version and that both patches still apply cleanly to main and the current release base (v2.338.2). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
yanksyoon
approved these changes
Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps our fork's
NODE22_VERSIONpin (used only for thelinux-arm/armv7l node22 fallback, introduced in PR #155) from22.22.3to22.23.4.Why
NODE22_VERSIONis a fork-only constant insrc/Misc/externals.sh— upstreamactions/runnerhas no equivalent and never bumps it for us (unlikeNODE20_VERSION/NODE24_VERSION, which we inherit automatically from upstream's own releases, e.g. theNODE24_VERSIONbump already picked up in #262).It was last pinned at
22.22.3(released 2026-05-13), which predates the Node.js October 21, 2026 security release and is missing fixes for:dns.resolve*()truncates hostnames containing a NUL bytecrypto.randomUUID()/randomInt()entropy cache reused across snapshotsfs.realpathSync()22.23.4is the actual Node.js 22.x LTS release that fixes all of the above.Validation
https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-armv7l.tar.gzexists (HTTP 200).git apply --checkpasses for bothrunner-main-sdk8-arm.patch(againstmain) andrunner-sdk8-arm.patch(against the current release basev2.338.2).runner-main-sdk8-arm.patchto a scratch checkout and confirmedsrc/Misc/externals.shresolves toNODE22_VERSION="22.23.4"correctly; full./dev.sh testrun in progress/validated separately.Scope
Patch-file-only change (no direct
src/commits), consistent with this fork's established pattern (see #232).