From 2a335a8f3560ab16bc4fe5cd4956939def32ad46 Mon Sep 17 00:00:00 2001 From: Luis Ortiz <2839770+anobjectn@users.noreply.github.com> Date: Wed, 28 Oct 2026 15:34:04 -0400 Subject: [PATCH 1/4] fix(deps): pin Node 24.22.1 for the October 21, 2026 security release Node.js 24.14.0 carries CVE-2026-111497 ("Node2Shell"), an out-of-bounds write in the bundled Brotli decoder that can lead to remote code execution, plus several high-severity DNS, TLS and URL-parsing fixes. 24.22.1 is the first patched 24.x release. - Dockerfile: node:24.22.1-slim, digest re-pinned to the multi-arch index - CI: 24.22.1 in the verify matrix and the other two jobs; the allocation-gate requirement now keys on 24.22.1 - Docs: contributor setup and the dependency baseline name 24.22.1 The engines floor and the setup doctor are unchanged. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/ci.yml | 8 ++++---- CONTRIBUTING.md | 8 +++++--- Dockerfile | 2 +- README.md | 5 +++-- docs/CURRENT-STATE.md | 4 +++- 5 files changed, 16 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ce3563685..766f0cc51 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,10 +20,10 @@ jobs: strategy: fail-fast: false matrix: - node: [24.14.0, 26.x] + node: [24.22.1, 26.x] env: PUPPETEER_SKIP_DOWNLOAD: '1' - GEV_REQUIRE_ALLOCATION_GATE: ${{ matrix.node == '24.14.0' && '1' || '0' }} + GEV_REQUIRE_ALLOCATION_GATE: ${{ matrix.node == '24.22.1' && '1' || '0' }} steps: - name: Check out source uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 @@ -76,7 +76,7 @@ jobs: - name: Use Node.js uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 24.14.0 + node-version: 24.22.1 cache: npm - name: Install locked dependencies and headless Chrome @@ -131,7 +131,7 @@ jobs: - name: Use Node.js uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 24.14.0 + node-version: 24.22.1 cache: npm - name: Run the Pinokio install path diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a7fe8ab76..591cdd85d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -4,13 +4,15 @@ Thanks for being here. God's Eye View is an open foundation for live spatial int ## Getting set up -Use Node.js 24.14.x or 26.x (also enforced by `package.json`). +Use Node.js 24.14.x or 26.x (also enforced by `package.json`). Prefer 24.22.1 or +later: earlier releases lack the October 21, 2026 security fixes, including +CVE-2026-111497 (a Brotli decoder flaw that can lead to remote code execution). ```bash git clone https://github.com/bilawalsidhu/gods-eye-view.git cd gods-eye-view -nvm install 24.14.0 -nvm use 24.14.0 +nvm install 24.22.1 +nvm use 24.22.1 npm install npm run doctor ./scripts/dev-fresh.sh # or: npm run dev (keys are optional) diff --git a/Dockerfile b/Dockerfile index 433d170a8..e711ec1d9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ # proxies (ADS-B, AIS, Overpass, OpenAI Realtime, ...) as middleware, so there # is nothing else to containerise. See compose.yaml for the usual entry point. # Same Node as CI (package.json engines, .github/workflows), pinned by digest. -FROM node:24.14.0-slim@sha256:d8e448a56fc63242f70026718378bd4b00f8c82e78d20eefb199224a4d8e33d8 +FROM node:24.22.1-slim@sha256:be8204d4bd327363357f532187b752ff62759c31bedf98e9e18fc08c9cbd605c # Puppeteer is only used by the QA scripts; skip its ~150MB Chromium download. ENV PUPPETEER_SKIP_DOWNLOAD=1 diff --git a/README.md b/README.md index 0a7509efa..ee9c7819a 100644 --- a/README.md +++ b/README.md @@ -129,8 +129,9 @@ hardware; it does not establish a minimum GPU requirement. ### Path 2 — Terminal / coding agent -Use **Node.js 24.x (24.14.0 or later) or 26.x**. The setup doctor warns about -Node 25, which is end-of-life. +Use **Node.js 24.x (24.14.0 or later) or 26.x**; 24.22.1 or later (26.12.1 or +later on 26) includes the October 21, 2026 security fixes, among them +CVE-2026-111497. The setup doctor warns about Node 25, which is end-of-life. ```bash git clone https://github.com/bilawalsidhu/gods-eye-view.git diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 3e7f333a1..098bd3e83 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -6024,7 +6024,9 @@ The lockfile uses DOMPurify 3.4.17, protobufjs 8.8.0, PostCSS 8.5.28, source-map-js 1.2.2 and nanoid 3.3.19. Cesium remains on 1.138.0. Browser QA uses Puppeteer 25.10.0; image-processing tools use Sharp 0.35.5. QA scripts await Puppeteer's asynchronous executable-path lookup before testing or passing the path to Chrome. Supported Node versions remain -24.14.x and 26.x. Use `npm ci` to reproduce the checked-in dependency tree. +24.14.x and 26.x; the Docker image and CI pin 24.22.1, the first 24.x release with +the October 21, 2026 Node.js security fixes (including CVE-2026-111497). Use +`npm ci` to reproduce the checked-in dependency tree. ### Traffic city navigation From 17d0877a4cedf1b44b9ce8f0927654ef5436390d Mon Sep 17 00:00:00 2001 From: Luis Ortiz <2839770+anobjectn@users.noreply.github.com> Date: Wed, 28 Oct 2026 15:35:06 -0400 Subject: [PATCH 2/4] docs(changelog): add the #1458 fragment Co-Authored-By: Claude Sonnet 5.5 --- changelog.d/1458-node-24-22-1-security-release.md | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 changelog.d/1458-node-24-22-1-security-release.md diff --git a/changelog.d/1458-node-24-22-1-security-release.md b/changelog.d/1458-node-24-22-1-security-release.md new file mode 100644 index 000000000..a440892a8 --- /dev/null +++ b/changelog.d/1458-node-24-22-1-security-release.md @@ -0,0 +1,3 @@ +- The Docker image and CI now pin Node 24.22.1, the first 24.x release with + the October 21, 2026 security fixes, including CVE-2026-111497 (a Brotli + decoder flaw that can lead to remote code execution) (anobjectn, #1458). From 16756bb790adb557208e55c2506994e3993cccf8 Mon Sep 17 00:00:00 2001 From: Sameh Khamis Date: Mon, 2 Nov 2026 07:03:49 -0800 Subject: [PATCH 3/4] Align the doctor, state doc and bug template with the 24.22.1 pin, and credit the author --- .github/ISSUE_TEMPLATE/bug_report.yml | 2 +- CONTRIBUTING.md | 6 +++--- changelog.d/1458-node-24-22-1-security-release.md | 4 ++-- docs/CURRENT-STATE.md | 5 +++-- scripts/setup-doctor.mjs | 2 +- 5 files changed, 10 insertions(+), 9 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 016576bf8..9069c648d 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -40,7 +40,7 @@ body: attributes: label: OS, Node version, browser description: Include the versions you can find. Write "unknown" for anything unavailable. - placeholder: "Windows 11, Node 24.14.0, Chrome 151" + placeholder: "Windows 11, Node 24.22.1, Chrome 151" validations: required: true - type: input diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 341252ba4..5850fe650 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -4,9 +4,9 @@ Thanks for being here. God's Eye View is an open foundation for live spatial int ## Getting set up -Use Node.js 24.14.x or 26.x (also enforced by `package.json`). Prefer 24.22.1 or -later: earlier releases lack the October 21, 2026 security fixes, including -CVE-2026-111497 (a Brotli decoder flaw that can lead to remote code execution). +Use Node.js 24 (24.14.0 or later) or 26.x (also enforced by `package.json`). +Prefer 24.22.1 or later: earlier releases lack the October 21, 2026 security +fixes, including CVE-2026-111497 (a Brotli decoder flaw). ```bash git clone https://github.com/bilawalsidhu/gods-eye-view.git diff --git a/changelog.d/1458-node-24-22-1-security-release.md b/changelog.d/1458-node-24-22-1-security-release.md index a440892a8..8c8cdd318 100644 --- a/changelog.d/1458-node-24-22-1-security-release.md +++ b/changelog.d/1458-node-24-22-1-security-release.md @@ -1,3 +1,3 @@ - The Docker image and CI now pin Node 24.22.1, the first 24.x release with - the October 21, 2026 security fixes, including CVE-2026-111497 (a Brotli - decoder flaw that can lead to remote code execution) (anobjectn, #1458). + the October 21, 2026 security fixes, including CVE-2026-111497 in the Brotli + decoder (Luis Ortiz, @anobjectn, #1458). diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index c872b609c..bf5d99fc7 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -3433,7 +3433,8 @@ down | auth-failed` (plus the unchanged `missing-key`/`unsupported`) with > style-switch persistence state. Browser/GPU performance comparison remains > operator-side; the final accounting records only comparable population > reductions and deterministic Node allocation/solve measurements. Those -> allocation gates are calibrated on Node.js 24.14.x; `package.json` permits +> allocation gates were calibrated on Node.js 24.14.x and run in CI on the +> pinned Node.js 24.22.1 with the same ceilings; `package.json` permits > supported product runtimes on Node 24 or 26, while the allocation runner > separately enforces Node 24 for these two calibrated probes. Each probe > compiles synchronously and discards explicit-GC @@ -6180,7 +6181,7 @@ The lockfile uses DOMPurify 3.4.17, protobufjs 8.8.0, PostCSS 8.5.28, source-map-js 1.2.2 and nanoid 3.3.19. Cesium remains on 1.138.0. Browser QA uses Puppeteer 25.10.0; image-processing tools use Sharp 0.35.5. QA scripts await Puppeteer's asynchronous executable-path lookup before testing or passing the path to Chrome. Supported Node versions remain -24.14.x and 26.x; the Docker image and CI pin 24.22.1, the first 24.x release with +Node 24 (24.14.0 or later) and 26.x; the Docker image and CI pin 24.22.1, the first 24.x release with the October 21, 2026 Node.js security fixes (including CVE-2026-111497). Use `npm ci` to reproduce the checked-in dependency tree. diff --git a/scripts/setup-doctor.mjs b/scripts/setup-doctor.mjs index 7075be2c1..600e96b09 100644 --- a/scripts/setup-doctor.mjs +++ b/scripts/setup-doctor.mjs @@ -57,7 +57,7 @@ export function classifyNodeVersion(version = process.versions.node) { // NEWER than this release has verified is a warning, never a refusal: a // future Node must not brick a no-terminal install with advice its user // cannot follow. Too-old stays an error above — old runtimes genuinely fail. - return { level: 'warn', summary: 'newer than this release has verified; Node 24.14.x or 26.x is the tested path' }; + return { level: 'warn', summary: 'newer than this release has verified; Node 24.22.x or 26.x is the tested path' }; } /** Verify that every direct package declared by this checkout is present. */ From d646fdbe60c40e7194a387067ed494100efb5e97 Mon Sep 17 00:00:00 2001 From: Sameh Khamis Date: Mon, 2 Nov 2026 07:39:02 -0800 Subject: [PATCH 4/4] Pin Node 24.22.2, the current 24 LTS patch, keeping 24.22.1 as the security floor --- .github/ISSUE_TEMPLATE/bug_report.yml | 2 +- .github/workflows/ci.yml | 8 ++++---- CONTRIBUTING.md | 4 ++-- Dockerfile | 2 +- changelog.d/1458-node-24-22-1-security-release.md | 7 ++++--- docs/CURRENT-STATE.md | 7 ++++--- 6 files changed, 16 insertions(+), 14 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 9069c648d..b753f8fef 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -40,7 +40,7 @@ body: attributes: label: OS, Node version, browser description: Include the versions you can find. Write "unknown" for anything unavailable. - placeholder: "Windows 11, Node 24.22.1, Chrome 151" + placeholder: "Windows 11, Node 24.22.2, Chrome 151" validations: required: true - type: input diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 766f0cc51..63d1eb29b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,10 +20,10 @@ jobs: strategy: fail-fast: false matrix: - node: [24.22.1, 26.x] + node: [24.22.2, 26.x] env: PUPPETEER_SKIP_DOWNLOAD: '1' - GEV_REQUIRE_ALLOCATION_GATE: ${{ matrix.node == '24.22.1' && '1' || '0' }} + GEV_REQUIRE_ALLOCATION_GATE: ${{ matrix.node == '24.22.2' && '1' || '0' }} steps: - name: Check out source uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 @@ -76,7 +76,7 @@ jobs: - name: Use Node.js uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 24.22.1 + node-version: 24.22.2 cache: npm - name: Install locked dependencies and headless Chrome @@ -131,7 +131,7 @@ jobs: - name: Use Node.js uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 24.22.1 + node-version: 24.22.2 cache: npm - name: Run the Pinokio install path diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 5850fe650..9361e1f3c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -11,8 +11,8 @@ fixes, including CVE-2026-111497 (a Brotli decoder flaw). ```bash git clone https://github.com/bilawalsidhu/gods-eye-view.git cd gods-eye-view -nvm install 24.22.1 -nvm use 24.22.1 +nvm install 24.22.2 +nvm use 24.22.2 npm install npm run doctor ./scripts/dev-fresh.sh # or: npm run dev (keys are optional) diff --git a/Dockerfile b/Dockerfile index e711ec1d9..a9b8aebd9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ # proxies (ADS-B, AIS, Overpass, OpenAI Realtime, ...) as middleware, so there # is nothing else to containerise. See compose.yaml for the usual entry point. # Same Node as CI (package.json engines, .github/workflows), pinned by digest. -FROM node:24.22.1-slim@sha256:be8204d4bd327363357f532187b752ff62759c31bedf98e9e18fc08c9cbd605c +FROM node:24.22.2-slim@sha256:c86ecead9e55a5210ac1727de38a4ca840bf03dcaf34dc9749addbf383b1920c # Puppeteer is only used by the QA scripts; skip its ~150MB Chromium download. ENV PUPPETEER_SKIP_DOWNLOAD=1 diff --git a/changelog.d/1458-node-24-22-1-security-release.md b/changelog.d/1458-node-24-22-1-security-release.md index 8c8cdd318..d379a26f1 100644 --- a/changelog.d/1458-node-24-22-1-security-release.md +++ b/changelog.d/1458-node-24-22-1-security-release.md @@ -1,3 +1,4 @@ -- The Docker image and CI now pin Node 24.22.1, the first 24.x release with - the October 21, 2026 security fixes, including CVE-2026-111497 in the Brotli - decoder (Luis Ortiz, @anobjectn, #1458). +- The Docker image and CI now pin Node 24.22.2, the current 24 LTS patch. It + carries the October 21, 2026 security fixes first released in 24.22.1, + including CVE-2026-111497 in the Brotli decoder (Luis Ortiz, @anobjectn, + #1458). diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index 11df591b0..1792c73de 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -3436,7 +3436,7 @@ down | auth-failed` (plus the unchanged `missing-key`/`unsupported`) with > operator-side; the final accounting records only comparable population > reductions and deterministic Node allocation/solve measurements. Those > allocation gates were calibrated on Node.js 24.14.x and run in CI on the -> pinned Node.js 24.22.1 with the same ceilings; `package.json` permits +> pinned Node.js 24.22.2 with the same ceilings; `package.json` permits > supported product runtimes on Node 24 or 26, while the allocation runner > separately enforces Node 24 for these two calibrated probes. Each probe > compiles synchronously and discards explicit-GC @@ -6183,8 +6183,9 @@ The lockfile uses DOMPurify 3.4.17, protobufjs 8.8.0, PostCSS 8.5.28, source-map-js 1.2.2 and nanoid 3.3.19. Cesium remains on 1.138.0. Browser QA uses Puppeteer 25.10.0; image-processing tools use Sharp 0.35.5. QA scripts await Puppeteer's asynchronous executable-path lookup before testing or passing the path to Chrome. Supported Node versions remain -Node 24 (24.14.0 or later) and 26.x; the Docker image and CI pin 24.22.1, the first 24.x release with -the October 21, 2026 Node.js security fixes (including CVE-2026-111497). Use +Node 24 (24.14.0 or later) and 26.x; the Docker image and CI pin 24.22.2, +the current 24 LTS patch, which carries the October 21, 2026 Node.js security +fixes first released in 24.22.1 (including CVE-2026-111497). Use `npm ci` to reproduce the checked-in dependency tree. ### Traffic city navigation