fix: runner on patched Node 24.22.1+ (CVE-2026-111497) - #30

Research Review

Verified

• Dockerfile hunk: setup_lts.x to setup_24.x. The live NodeSource setup_24.x script sets NODE_VERSION="24.x" (fetched 2026-10-23). The architect triage confirmed that the node_24.x index lists 24.22.1.
• Build gate logic: I ran the M!==24||m<22||(m===22&&p<1) expression against sample versions. 24.22.1 and 24.23.0 pass; 24.22.0, 24.21.0, 25.0.0 and 24.9.9 fail. It behaves as the PR body says.
• The gate sits in the same RUN as the install and is chained with &&, so a failure aborts the build.
• Premise for the Brotli statement (AC3): the issue and triage place the only runner Node use at scripts/docker-entrypoint.sh:232, and the PR body repeats that. The body states that tenant code decides its own Brotli exposure, which is what AC3 asks for.
• Scope reductions row: it cites birme's web-runner#67 comment and the osaas-lib-orchestrator#319 body, as recorded in the 18:15Z issue comment. This resolves architect-reviewer BLOCK findings 1 to 3 (post-merge read marked "not a gate", lower orchestrator reading means waiting for #319).
• Lessons section is present and filled in. PR body carries the Claude attribution trailer.

Adjacent Stubs Detected

• None. The only touched file is Dockerfile, and it has no stub patterns.

Orphaned Files Detected

• None. Dockerfile is an entry point.

Escape Hatch Coverage

• Dockerfile gate: process.exit(1) when Node is below 24.22.1. This is a build-time guard, not a user-facing rejection. No legitimate user action is blocked. The only way to hit it is a NodeSource package older than the fix, which is the intended failure.
• Risk worth noting, not blocking: if NodeSource ever withdraws or lags 24.22.1+, the dev and prod remakes fail rather than silently ship a vulnerable image. That is the intended fail-loud behaviour. The gate also rejects Node 25 and later by design (M!==24). A deliberate move to 26 would need the gate edited.

Object Shape Verification

• No spreads or re-serialisation in the diff.

Contract diff

• No request handler or timeout changed. Files checked: Dockerfile only. The runtime Node patch version changes within major 24.

Existing consumers

• Not a compliance/standards PR. The PR body states Node 24.20/24.21 to at least 24.22.1 with the same major, and Python code is unaffected.

Impact Analysis

• Blast radius: the python-runner image, covering the 53 tenants on stable and 54 on latest. Pinned stable tenants are unaffected until birme promotes :latest.
• Downstream consumers: tenant code that starts Node gets the patched version on its next restart on the new tag. The @osaas/cli call in the entrypoint runs on the new Node. I did not check other repos, since this is a single-file Dockerfile change.
• Coordinated changes needed: none for merge. The prod release, which publishes a GitHub release to trigger sync-fork-prod.yml, is birme's call. The python-runner-orchestrator image is deferred to osaas-lib-orchestrator#319.
• Breaking change risk: low. It is a patch-level Node bump in the same major.

Risks Not Tested

• The image build itself was not run. There is no image-build CI in this repo (gh pr checks reports no checks) and the reviewer has no docker. The build gate and the merge-triggered "Sync fork in dev" run are the only checks.
• Whether the apt-installed nodejs resolves to a version at or above 24.22.1 (NodeSource publishes two package suffixes for 24.22.1) is only confirmed through the NodeSource index per the triage.
• The post-merge dev read of the runner and orchestrator images was not performed. It is stated as not a gate.
• Brotli reachability in tenant code is unknowable from this repo.

Research Suggestions

• After merge, confirm the "Sync fork in dev" run succeeded and that the dev image's nodejs is at least 24.22.1, as the PR body lists.

Verdict

No blocking issues found.

Reviewed by PR Research Validator. This review checks whether code is based on verified sources rather than assumptions.