[skyfriends]

The API image uses Node 20.7.0 with its older bundled trust store. This removes the emSign ECC G3, emSign TLS G3 when present, and AAA cross-signing anchors from the Debian CA bundle, then selects that bundle for Node through --use-openssl-ca. Both builder and runtime inherit the policy from the existing base stage. A build-time guard parses the selected bundle and rejects missing or still-affected trust.

Validation: Unchanged official Node 20.7.0 with the filtered CA bundle rejected all 12 disclosed chains through fetch and HTTPS and succeeded for six healthy controls. Positive/negative bundle guard checks, CA configuration filtering, and git diff --check passed. Docker was not run; image build and deployment remain unverified.

This is a temporary trust-root mitigation pending a compatible Node release containing the upstream intermediate-key blocklist. Certificates whose only trust path uses the removed roots are also rejected. Explicit application CA overrides and already-running processes require separate verification.

Reference: nodejs/node#66871

Desktop/manual application testing was not performed.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 83de3036-1c1f-40bc-b72f-aa9ee4934653

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}