From 5c8e2fdb03404de73c4210343d3fb42e20bf054a Mon Sep 17 00:00:00 2001 From: Paul Hovley Date: Fri, 23 Oct 2026 11:28:56 -0600 Subject: [PATCH] Pin Bun to 1.4.4 to pick up Brotli decoder fix (CVE-2026-111497) Bun bundles the same Google Brotli decoder as Node.js and is affected by CVE-2026-111497; the fix shipped in Bun 1.4.4. Pin the base image so the patched runtime is verifiable, and force the CI build to pull the base image so a cached layer can never reintroduce an unpatched runtime. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/build.yaml | 1 + Dockerfile | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 8a4d847..19b4e82 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -51,5 +51,6 @@ jobs: uses: docker/build-push-action@v4 with: context: . + pull: true push: true tags: ${{ steps.prep.outputs.TAGS }} diff --git a/Dockerfile b/Dockerfile index b45bbf4..004ea52 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # use the official Bun image # see all versions at https://hub.docker.com/r/oven/bun/tags -FROM oven/bun:1 AS base +FROM oven/bun:1.4.4 AS base WORKDIR /usr/src/app # install dependencies into temp directory