From 9d1111146353a57bbd939d3822f9a125f43b63ba Mon Sep 17 00:00:00 2001 From: Pavel Loparev Date: Thu, 29 Oct 2026 20:48:11 +0200 Subject: [PATCH] fix: pin Node.js base image to patched 22.23.4 (CON-2396) node:22-slim is a floating tag; images built before 2026-10-21 can still run a Node.js vulnerable to CVE-2026-111497 (OOB write in the bundled Brotli decoder). Pin to node:22.23.4-slim, the first patched release, so the fix survives cache reuse. Co-Authored-By: Claude Sonnet 5 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 7c1a7e6..89bd731 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM --platform=linux/amd64 node:22-slim +FROM --platform=linux/amd64 node:22.23.4-slim RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates && rm -rf /var/lib/apt/lists/* && \ curl -fsSL https://smartling-connectors-releases.s3.amazonaws.com/cli/smartling.linux \