From ece8c29eba508b590dea9f50769aa867cd75bb80 Mon Sep 17 00:00:00 2001 From: Claude Agent Date: Fri, 23 Oct 2026 19:03:39 +0000 Subject: [PATCH] fix: install Node 24.x and gate build on >= 24.22.1 (CVE-2026-111497) Co-Authored-By: Claude --- Dockerfile | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index d460a72..27e0c8b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,9 +16,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ gnupg \ && rm -rf /var/lib/apt/lists/* -# Install Node.js (required for OSC CLI) -RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - \ +# Install Node.js (required for OSC CLI). Pinned to the 24.x line (not setup_lts.x) +# for CVE-2026-111497; the build fails below the fixed release 24.22.1. +RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \ && apt-get install -y nodejs \ + && node -e 'const [M,m,p]=process.versions.node.split(".").map(Number); if (M!==24||m<22||(m===22&&p<1)) { console.error("Node "+process.versions.node+" is below 24.22.1 (CVE-2026-111497)"); process.exit(1) }' \ + && node --version \ && rm -rf /var/lib/apt/lists/* RUN pip install gradio