Repository navigation
docs: note that the 2026-10-14-002 images patch CVE-2026-111497 - #68
Merged
Merged
Conversation
The chart on main defaults to the 2026-10-14-002 images, which run Node.js 24.22.1; chart 1.0.0 defaults to 2026-10-14-001, on 24.22.0. The entry sits under Unreleased until the 1.0.1 release folds it in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TS6ppY7G8Vo6SVG95NLyrV
|
| User | Commit | Date |
|---|---|---|
| david.mountney@twkie.net | docs: note that the 20... | October 23, 2026 |
| dj@currents.dev | docs: spell out the 1.... | October 14, 2026 |
![baz-app[bot]](https://avatars.githubusercontent.com/in/1124379?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Owner: @twk3
Adds an Unreleased → Security entry to
CHANGELOG.md. The2026-10-14-002images, which the chart onmaindefaults to since #66, run Node.js 24.22.1. That version fixes CVE-2026-111497, an out-of-bounds write in the Node.js Brotli decoder (node:zlib). Chart1.0.0defaults to2026-10-14-001, which runs Node.js 24.22.0 without the fix, so the entry tells1.0.0installs to setcurrents.imageTag: 2026-10-14-002.The entry sits under
[Unreleased]because chart1.0.1isn't cut yet.scripts/update-changelog.sh(git-cliff) prepends the generatedcurrents-1.0.1section above it, so the release PR moves this entry into that section, as #65 did for1.0.0.How it was checked: I read
NODE_VERSIONfrom each image's config in ECR (currents/on-prem/*), for every platform of every service.2026-10-14-002runs 24.22.1 on arm64 and amd64.2026-10-14-001runs 24.22.0.🤖 Generated with Claude Code
https://claude.ai/code/session_01TS6ppY7G8Vo6SVG95NLyrV
Need help on this PR? Tag
@codesmith-botwith what you need.