Skip to content

fix(security): Node 22.23.4 base pinned by digest; protobufjs 6.11.6 #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gascity-infra-agent merged 1 commit into from
Nov 5, 2026
Merged

fix(security): Node 22.23.4 base pinned by digest; protobufjs 6.11.6 #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions docker/hyperdx/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,12 @@
# - Mongo
# - Otel Collector (otelcol)

ARG NODE_VERSION=22.22
# Pinned by digest: the multi-arch index of node:22.23.4-alpine3.24 (Node security
# release for CVE-2026-111497 Brotli, plus the 22.23.4 TLS/DNS fixes). Bump
# NODE_VERSION and NODE_DIGEST together; get the digest with
# `crane digest node:<version>-alpine3.24`.
ARG NODE_VERSION=22.23.4
ARG NODE_DIGEST=sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914
ARG CLICKHOUSE_VERSION=26.8
ARG OTEL_COLLECTOR_VERSION=0.155.0
ARG OTEL_COLLECTOR_CORE_VERSION=1.61.0
Expand Down Expand Up @@ -42,7 +47,7 @@ RUN go mod download
COPY packages/otel-collector/ ./
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /migrate ./cmd/migrate

FROM node:${NODE_VERSION}-alpine AS node_base
FROM node:${NODE_VERSION}-alpine3.24@${NODE_DIGEST} AS node_base

WORKDIR /app

Expand Down Expand Up @@ -104,7 +109,7 @@ RUN --mount=type=cache,target=/root/.yarn/berry/cache,id=yarn-cache \


# prod ############################################################################################
FROM node:${NODE_VERSION}-alpine AS prod
FROM node:${NODE_VERSION}-alpine3.24@${NODE_DIGEST} AS prod

LABEL org.opencontainers.image.vendor="HyperDX" \
org.opencontainers.image.title="HyperDX Production" \
Expand Down
3 changes: 2 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,8 @@
"on-headers": "^1.1.0",
"fast-xml-parser": "^4.5.6",
"systeminformation": "^5.24.0",
"@asyncapi/specs": "6.11.1"
"@asyncapi/specs": "6.11.1",
"@hyperdx/otel-web-session-recorder/protobufjs": "~6.11.6"
},
"resolutionsNotes": {
"@stryker-mutator/core/minimatch": "Dev tooling, not a CVE override. Added when a blanket `brace-expansion` pin forced v2 (CJS) while minimatch v10 needs v5's named exports. That blanket pin is gone — it broke `nx affected` the same way — so brace-expansion now resolves per consumer and Stryker would most likely work on minimatch v10. The pin stays because no CI job runs `yarn dev:mutation`, so nothing would catch it if that guess is wrong. Drop it once someone has run the mutation suite on v10. See CONTRIBUTING.md#mutation-tests."
Expand Down
8 changes: 4 additions & 4 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25965,9 +25965,9 @@ __metadata:
languageName: node
linkType: hard

"protobufjs@npm:~6.11.2":
version: 6.11.4
resolution: "protobufjs@npm:6.11.4"
"protobufjs@npm:~6.11.6":
version: 6.11.6
resolution: "protobufjs@npm:6.11.6"
dependencies:
"@protobufjs/aspromise": "npm:^1.1.2"
"@protobufjs/base64": "npm:^1.1.2"
Expand All @@ -25985,7 +25985,7 @@ __metadata:
bin:
pbjs: bin/pbjs
pbts: bin/pbts
checksum: 10c0/c244d7b9b6d3258193da5c0d1e558dfb47f208ae345e209f90ec45c9dca911b90fa17e937892a9a39a4136ab9886981aae9efdf6039f7baff4f7225f5eeb9812
checksum: 10c0/a7ed63a75b86c7d22abdfef48e9775f373befbaad4beceadf5bd047066365d735386d57851b35f89ae2c1afdea2da1c93a17682aa9a4a8f3df7ca54ccdce309b
languageName: node
linkType: hard

Expand Down
Loading