From 7ca9afee63dc768a7c0ba81e743665da163d8009 Mon Sep 17 00:00:00 2001 From: DJ Mountney Date: Fri, 23 Oct 2026 16:31:02 -0700 Subject: [PATCH] docs: note that the 2026-10-14-002 images patch CVE-2026-111497 The chart on main defaults to the 2026-10-14-002 images, which run Node.js 24.22.1; chart 1.0.0 defaults to 2026-10-14-001, on 24.22.0. The entry sits under Unreleased until the 1.0.1 release folds it in. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01TS6ppY7G8Vo6SVG95NLyrV --- CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index fa87459..f9448bc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## [Unreleased] + +### Security +- The `2026-10-14-002` images run Node.js 24.22.1, which fixes [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497): an out-of-bounds write in the Brotli decoder of `node:zlib`, through which crafted Brotli data can corrupt memory and possibly run code. Chart `1.0.0` defaults to `2026-10-14-001`, which runs Node.js 24.22.0 without the fix; on `1.0.0`, set `currents.imageTag: 2026-10-14-002` to get it. + + ## [currents-1.0.0](https://github.com/currents-dev/helm-charts/releases/tag/currents-1.0.0) - 2026-10-14 Images `2026-10-14-001`, the first Currents on-prem feature release since `2026-07-26`, and the chart's first major version. It breaks SAML SSO sign-in until you update your identity provider, so read [Upgrading to Chart 1.0](docs/eks/upgrade-1.0.md) before you upgrade. From 1.0.0 the chart follows semantic versioning (see [Chart Versions](docs/README.md#chart-versions)).