From 4dab932d3ee1bf9b0b388c4ee9c64f7b24cc5fdb Mon Sep 17 00:00:00 2001 From: Andy Potanin Date: Wed, 21 Oct 2026 11:42:27 -0400 Subject: [PATCH 1/2] fix(security): bump Node.js to 24.22.1 (October 2026 security release) Addresses the October 21, 2026 Node.js security release: rejects TLS chains containing eMudhra keys blocked by Chrome/Firefox, updates bundled root certs to NSS 3.131.1, and fixes four HIGH CVEs including TLS hostname verification bypass via alternate IPv4 spellings. --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 6eebbae..95bf3d1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,7 +5,7 @@ FROM usabilitydynamics/udx-worker:0.58.0 LABEL version="0.32.0" # Set build arguments for Node.js, npm, and application port -ARG NODE_VERSION=24.22.0 +ARG NODE_VERSION=24.22.1 ARG NPM_VERSION=12.2.0 ARG APP_PORT=8080 From 46a0b4965de66600d7c51f852c1dedf2a028cdd4 Mon Sep 17 00:00:00 2001 From: Andy Potanin Date: Wed, 21 Oct 2026 14:24:00 -0400 Subject: [PATCH 2/2] chore: rebase on udx-worker:0.59.0 (ubuntu:26.04) The 25.10 base went EOL on 2026-07-09 and no longer receives security updates. Bumps the base to the 26.04 rebuild and the xz-utils pin to 26.04's candidate. Requires udx-worker 0.59.0 to be published first (ubuntu:26.04 rebase PR); do not merge before that lands. --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 95bf3d1..7a6c850 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Use a pinned udx-worker release -FROM usabilitydynamics/udx-worker:0.58.0 +FROM usabilitydynamics/udx-worker:0.59.0 # Add metadata labels LABEL version="0.32.0" @@ -28,7 +28,7 @@ WORKDIR /tmp # Install required packages for Node.js extraction RUN set -ex && \ apt-get update && \ - apt-get install -y --no-install-recommends xz-utils=5.8.1-1ubuntu0.1 && \ + apt-get install -y --no-install-recommends xz-utils=5.8.3-1ubuntu0.1 && \ rm -rf /var/lib/apt/lists/* # Install Node.js