From e545a1c7515796d587eb8c1eabbf83d738c1cc74 Mon Sep 17 00:00:00 2001 From: shellsort <> Date: Thu, 29 Oct 2026 18:09:42 +0100 Subject: [PATCH] Fix CVE-2026-111497: Node 22.23.4, nginx 1.30.6 --- .github/workflows/client.yml | 2 +- .github/workflows/node-service.yml | 2 +- deploy/docker/Dockerfile | 23 +++++++++++------------ 3 files changed, 13 insertions(+), 14 deletions(-) diff --git a/.github/workflows/client.yml b/.github/workflows/client.yml index 9b59defb40..193a3be8fb 100644 --- a/.github/workflows/client.yml +++ b/.github/workflows/client.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - node-version: [ 20.x ] + node-version: [ 22.x ] steps: - uses: actions/checkout@v3 with: diff --git a/.github/workflows/node-service.yml b/.github/workflows/node-service.yml index 4e94b8564c..9040de5d5e 100644 --- a/.github/workflows/node-service.yml +++ b/.github/workflows/node-service.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - node-version: [ 20.x ] + node-version: [ 22.x ] steps: - uses: actions/checkout@v3 with: diff --git a/deploy/docker/Dockerfile b/deploy/docker/Dockerfile index 7b307946f2..94055d35ea 100644 --- a/deploy/docker/Dockerfile +++ b/deploy/docker/Dockerfile @@ -58,7 +58,7 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install --no-instal # Add nodejs repo and keys RUN mkdir -p /etc/apt/keyrings \ && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \ - && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list + && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list # Download nodejs and install yarn RUN apt-get update \ @@ -90,7 +90,7 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install --no-instal # Add nodejs repo and keys RUN mkdir -p /etc/apt/keyrings \ && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \ - && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list + && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list # Download nodejs and install yarn RUN apt-get update \ @@ -110,7 +110,7 @@ CMD [ "/bin/sh", "/lowcoder/node-service/entrypoint.sh" ] ## ## Build lowcoder client application ## -FROM node:20.2-slim AS build-client +FROM node:22.23.4-slim AS build-client # curl is required for yarn build to succeed, because it calls it while building client RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates @@ -147,7 +147,7 @@ RUN yarn build ## To create a separate image out of it, build it with: ## DOCKER_BUILDKIT=1 docker build -f deploy/docker/Dockerfile -t lowcoderorg/lowcoder-ce-frontend --target lowcoder-ce-frontend . ## -FROM nginx:1.27.1 AS lowcoder-ce-frontend +FROM nginx:1.30.6 AS lowcoder-ce-frontend LABEL maintainer="lowcoder" # Change default nginx user into lowcoder user and remove default nginx config @@ -188,7 +188,7 @@ EXPOSE 3443 ## ## Build lowcoder client (Enterprise) application ## -FROM node:20.2-slim AS build-client-ee +FROM node:22.23.4-slim AS build-client-ee # curl is required for yarn build to succeed, because it calls it while building client RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates @@ -225,7 +225,7 @@ RUN yarn build ## To create a separate image out of it, build it with: ## DOCKER_BUILDKIT=1 docker build -f deploy/docker/Dockerfile -t lowcoderorg/lowcoder-ee-frontend --target lowcoder-ee-frontend . ## -FROM nginx:1.27.1 AS lowcoder-enterprise-frontend +FROM nginx:1.30.6 AS lowcoder-enterprise-frontend LABEL maintainer="lowcoder" # Change default nginx user into lowcoder user and remove default nginx config @@ -277,18 +277,18 @@ RUN apt-get update \ # Add required apt repositories and signing keys RUN curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /usr/share/keyrings/nodesource-keyring.gpg \ - && echo "deb [signed-by=/usr/share/keyrings/nodesource-keyring.gpg] https://deb.nodesource.com/node_20.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list \ + && echo "deb [signed-by=/usr/share/keyrings/nodesource-keyring.gpg] https://deb.nodesource.com/node_22.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list \ && curl -fsSL https://packages.redis.io/gpg | gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg \ && echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb `lsb_release -cs` main" | tee /etc/apt/sources.list.d/redis.list \ && curl -fsSL https://www.mongodb.org/static/pgp/server-7.0.asc | gpg --dearmor -o /usr/share/keyrings/mongodb-archive-keyring.gpg \ && echo "deb [signed-by=/usr/share/keyrings/mongodb-archive-keyring.gpg] https://repo.mongodb.org/apt/ubuntu `lsb_release -cs`/mongodb-org/7.0 multiverse" | tee /etc/apt/sources.list.d/mongodb-org-7.0.list \ && curl -fsSL https://nginx.org/keys/nginx_signing.key | gpg --dearmor -o /usr/share/keyrings/nginx-archive-keyring.gpg \ - && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/mainline/ubuntu `lsb_release -cs` nginx" | tee /etc/apt/sources.list.d/nginx.list + && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/ubuntu `lsb_release -cs` nginx" | tee /etc/apt/sources.list.d/nginx.list # Install required packages RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get -y install --no-install-recommends -y \ - nginx=1.27.1-1~jammy \ + nginx=1.30.6-1~jammy \ mongodb-org \ redis \ supervisor \ @@ -302,8 +302,8 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get -y install --no-ins # Use configuration setup from official nginx image RUN rm -rf /etc/nginx/nginx.conf -COPY --from=nginx:1.27.1 /docker-entrypoint.d /docker-entrypoint.d -COPY --from=nginx:1.27.1 /docker-entrypoint.sh /docker-entrypoint.sh +COPY --from=nginx:1.30.6 /docker-entrypoint.d /docker-entrypoint.d +COPY --from=nginx:1.30.6 /docker-entrypoint.sh /docker-entrypoint.sh # Add lowcoder user RUN usermod --login lowcoder --uid 9001 nginx \ @@ -363,4 +363,3 @@ EXPOSE 3443 ENTRYPOINT [ "/bin/sh" , "/lowcoder/entrypoint.sh" ] CMD ["/usr/bin/supervisord", "-n" , "-c" , "/lowcoder/etc/supervisord.conf"] -