Fix CVE-2026-111497: pin Node 22.23.4/26.12.1, nginx 1.30.6

deploy/docker/Dockerfile

@@ -112,7 +112,7 @@ CMD [ "/bin/sh", "/lowcoder/node-service/entrypoint.sh" ]
 ##
 ## Standalone image is built from server/proxy-service/Dockerfile
 ##
-FROM node:22.23-slim AS build-proxy-service
+FROM node:22.23.4-slim AS build-proxy-service
 
 # Copy only the build inputs, so local build/ and node_modules folders are never picked up
 COPY server/proxy-service/package.json server/proxy-service/yarn.lock server/proxy-service/tsconfig.json /lowcoder/proxy-service/app/
@@ -137,7 +137,7 @@ RUN chmod +x /lowcoder/proxy-service/*.sh
 ##
 ## Standalone image is built from deploy/docker/agora-token-service/Dockerfile
 ##
-FROM node:22.23-slim AS build-agora-token-service
+FROM node:22.23.4-slim AS build-agora-token-service
 
 WORKDIR /lowcoder/agora-token-service/app
 COPY deploy/docker/agora-token-service/package.json ./
@@ -157,7 +157,7 @@ RUN chmod +x /lowcoder/agora-token-service/*.sh
 ## HOCUSPOCUS_SERVER_VERSION in sync with it.
 ## @hocuspocus/server 4.x requires node >= 22.
 ##
-FROM node:22.23-slim AS build-hocuspocus
+FROM node:22.23.4-slim AS build-hocuspocus
 
 ARG HOCUSPOCUS_SERVER_VERSION=4.3.0
 
@@ -176,7 +176,7 @@ RUN chmod +x /lowcoder/hocuspocus/*.sh
 ##
 ## Build lowcoder client application
 ##
-FROM node:22.23-slim AS build-client
+FROM node:22.23.4-slim AS build-client
 
 # curl is required for yarn build to succeed, because it calls it while building client
 RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates
@@ -217,7 +217,7 @@ RUN yarn build
 ## To create a separate image out of it, build it with:
 ##   DOCKER_BUILDKIT=1 docker build -f deploy/docker/Dockerfile -t lowcoderorg/lowcoder-ce-frontend --target lowcoder-ce-frontend .
 ##
-FROM nginx:1.27.1 AS lowcoder-ce-frontend
+FROM nginx:1.30.6 AS lowcoder-ce-frontend
 LABEL maintainer="lowcoder"
 
 # Change default nginx user into lowcoder user and remove default nginx config
@@ -258,7 +258,7 @@ EXPOSE 3443
 ##
 ## Build lowcoder client (Enterprise) application
 ##
-FROM node:22.23-slim AS build-client-ee
+FROM node:22.23.4-slim AS build-client-ee
 
 # curl is required for yarn build to succeed, because it calls it while building client
 RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates
@@ -299,7 +299,7 @@ RUN yarn build
 ## To create a separate image out of it, build it with:
 ##   DOCKER_BUILDKIT=1 docker build -f deploy/docker/Dockerfile -t lowcoderorg/lowcoder-ee-frontend --target lowcoder-ee-frontend .
 ##
-FROM nginx:1.27.1 AS lowcoder-enterprise-frontend
+FROM nginx:1.30.6 AS lowcoder-enterprise-frontend
 LABEL maintainer="lowcoder"
 
 # Change default nginx user into lowcoder user and remove default nginx config
@@ -357,12 +357,12 @@ RUN curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg -
   && curl -fsSL https://www.mongodb.org/static/pgp/server-7.0.asc | gpg --dearmor -o /usr/share/keyrings/mongodb-archive-keyring.gpg \
   && echo "deb [signed-by=/usr/share/keyrings/mongodb-archive-keyring.gpg] https://repo.mongodb.org/apt/ubuntu `lsb_release -cs`/mongodb-org/7.0 multiverse" | tee /etc/apt/sources.list.d/mongodb-org-7.0.list \
   && curl -fsSL https://nginx.org/keys/nginx_signing.key | gpg --dearmor -o /usr/share/keyrings/nginx-archive-keyring.gpg \
-  && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/mainline/ubuntu `lsb_release -cs` nginx" | tee /etc/apt/sources.list.d/nginx.list
+  && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/ubuntu `lsb_release -cs` nginx" | tee /etc/apt/sources.list.d/nginx.list
 
 
 # Install required packages
 RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get -y install --no-install-recommends -y \
-      nginx=1.27.1-1~jammy \
+      nginx=1.30.6-1~jammy \
       mongodb-org \
       redis \
       supervisor \
@@ -376,8 +376,8 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get -y install --no-ins
 
 # Use configuration setup from official nginx image
 RUN rm -rf /etc/nginx/nginx.conf
-COPY --from=nginx:1.27.1 /docker-entrypoint.d /docker-entrypoint.d
-COPY --from=nginx:1.27.1 /docker-entrypoint.sh /docker-entrypoint.sh
+COPY --from=nginx:1.30.6 /docker-entrypoint.d /docker-entrypoint.d
+COPY --from=nginx:1.30.6 /docker-entrypoint.sh /docker-entrypoint.sh
 
 # Add lowcoder user
 RUN usermod --login lowcoder --uid 9001 nginx \
@@ -450,4 +450,3 @@ EXPOSE 8081
 
 ENTRYPOINT [ "/bin/sh" , "/lowcoder/entrypoint.sh" ]
 CMD ["/usr/bin/supervisord", "-n" , "-c" , "/lowcoder/etc/supervisord.conf"]
-

deploy/docker/agora-token-service/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-alpine
+FROM node:22.23.4-alpine
 
 WORKDIR /app
 

deploy/docker/hocuspocus/Dockerfile

@@ -1,6 +1,6 @@
 # Hocuspocus (Yjs WebSocket) server for lowcoder ChatBox.
 # Build context: client/packages/lowcoder (see Dockerfile.dockerignore next to this file)
-FROM node:26-alpine
+FROM node:26.12.1-alpine
 
 ARG HOCUSPOCUS_SERVER_VERSION=4.3.0
 

server/proxy-service/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-alpine
+FROM node:22.23.4-alpine
 
 WORKDIR /lowcoder/proxy-service