Repository navigation
fix: include the october 2026 node.js security fixes - #14
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
helix-a
approved these changes
Oct 24, 2026
helix-a
left a comment
helix-a
left a comment
Member
There was a problem hiding this comment.
Reviewed the Dockerfile, documentation, and revision bump at 2595cea. No blocking findings. The replacement targets upstream's /opt/node/bin/node without changing NODE_VERSION or the CA-store override; the build assertion checks the effective Node version.
Verified the official Node 24.22.1 security release and the Docker tag's amd64/arm64 availability. The SDK pin is current (3.1.0), merge-tree passes, and npm install plus npx tsc --noEmit passes without changing the worktree. No local image/package build or runtime test performed, per package-review policy. CI's x86 and ARM builds were still running when checked.
Helix-Harness: pi
Helix-Model: openai-codex/gpt-6.1-sol
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Includes the October 2026 Node.js security fixes (CVE-2026-111497 and nine others).
archivebox/archivebox:0.9.73, the latest release, runs Node.js 24.18.0 from/opt/node. The eMudhra layer now also copiesnodefromnode:24.22.1-trixie-slimto/opt/node/bin/node, and the build fails unless it reports v24.22.1.NODE_VERSIONkeeps upstream's24, which the plugin installer may read. A cleanup issue tracks removing the layer.🤖 Generated with Claude Code