From 0836e57981da5e1ef8349b71501408d528f38c1e Mon Sep 17 00:00:00 2001 From: Coder Prototypes <294797144+coder-prototypes@users.noreply.github.com> Date: Fri, 23 Oct 2026 15:06:29 +0000 Subject: [PATCH 1/2] fix: bump Node.js to patched versions for CVE-2026-111497, bump blink-server to 0.1.6 Pin Node base images to releases that fix the Brotli decoder RCE (CVE-2026-111497): - blink-server and blink-agent images: node:22-alpine -> node:22.23.4-alpine - scout-agent Daytona image: NODE_VERSION 22.13.0 -> 22.23.4 - scout-agent Docker compute image: node:24-bullseye-slim -> node:24.22.1-bookworm-slim (the bullseye tag is no longer updated, so it would never get the fix) Also bump blink-server to 0.1.6 for the patch release. --- bun.lock | 2 +- packages/scout-agent/lib/compute/daytona/Dockerfile | 2 +- packages/scout-agent/lib/compute/docker.ts | 2 +- packages/server/docker/agent/Dockerfile | 2 +- packages/server/docker/server/Dockerfile | 2 +- packages/server/package.json | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/bun.lock b/bun.lock index ee93b283..fedf82bd 100644 --- a/bun.lock +++ b/bun.lock @@ -362,7 +362,7 @@ }, "packages/server": { "name": "blink-server", - "version": "0.1.5", + "version": "0.1.6", "bin": { "blink-server": "dist/cli.js", }, diff --git a/packages/scout-agent/lib/compute/daytona/Dockerfile b/packages/scout-agent/lib/compute/daytona/Dockerfile index a995e0b5..bd6643b0 100644 --- a/packages/scout-agent/lib/compute/daytona/Dockerfile +++ b/packages/scout-agent/lib/compute/daytona/Dockerfile @@ -46,7 +46,7 @@ ENV HOME=/home/blink WORKDIR /workspace ### NODE VIA NVM ### -ARG NODE_VERSION=22.13.0 +ARG NODE_VERSION=22.23.4 ENV NVM_DIR=/home/blink/.nvm ENV PATH=/home/blink/.local/bin:/home/blink/.local/bun/bin:$NVM_DIR/versions/node/v${NODE_VERSION}/bin:$PATH RUN mkdir -p $NVM_DIR \ diff --git a/packages/scout-agent/lib/compute/docker.ts b/packages/scout-agent/lib/compute/docker.ts index b5e4ad16..603867af 100644 --- a/packages/scout-agent/lib/compute/docker.ts +++ b/packages/scout-agent/lib/compute/docker.ts @@ -62,7 +62,7 @@ const BOOTSTRAP_SCRIPT_BASE64 = Buffer.from(BOOTSTRAP_SCRIPT).toString("base64"); const DOCKERFILE = ` -FROM node:24-bullseye-slim +FROM node:24.22.1-bookworm-slim RUN apt update && apt install git -y RUN (type -p wget >/dev/null || (apt update && apt install wget -y)) \\ diff --git a/packages/server/docker/agent/Dockerfile b/packages/server/docker/agent/Dockerfile index 9ae9a846..f8f685e9 100644 --- a/packages/server/docker/agent/Dockerfile +++ b/packages/server/docker/agent/Dockerfile @@ -12,7 +12,7 @@ COPY otel/builder-config.yaml . # Build the collector RUN builder --config builder-config.yaml -FROM node:22-alpine +FROM node:22.23.4-alpine # Install bash (for process substitution) RUN apk add --no-cache bash diff --git a/packages/server/docker/server/Dockerfile b/packages/server/docker/server/Dockerfile index ed85a706..1f07b9c6 100644 --- a/packages/server/docker/server/Dockerfile +++ b/packages/server/docker/server/Dockerfile @@ -1,4 +1,4 @@ -FROM node:22-alpine +FROM node:22.23.4-alpine # Install docker CLI for docker-in-docker via socket mounting RUN apk add --no-cache docker-cli diff --git a/packages/server/package.json b/packages/server/package.json index 7d1be6f9..268ab7af 100644 --- a/packages/server/package.json +++ b/packages/server/package.json @@ -1,7 +1,7 @@ { "name": "blink-server", "description": "Agents as a Service", - "version": "0.1.5", + "version": "0.1.6", "author": { "name": "Coder", "email": "support@coder.com", From e81946ac045fd29b58de734766eb79445deaf473 Mon Sep 17 00:00:00 2001 From: Coder Prototypes <294797144+coder-prototypes@users.noreply.github.com> Date: Fri, 23 Oct 2026 15:17:44 +0000 Subject: [PATCH 2/2] chore: update bun.lock and fix CI - Run bun install to sync bun.lock - Add trailing newline to packages/server/package.json (prettier) - Build websocket headers via Headers.forEach so client.node.ts typechecks without DOM iterable types - Omit user_id instead of passing null in agent-permissions test to match upsertAgentPermission's type --- bun.lock | 4 ++-- packages/server/package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bun.lock b/bun.lock index fedf82bd..23f8e9c5 100644 --- a/bun.lock +++ b/bun.lock @@ -1721,7 +1721,7 @@ "@types/mysql": ["@types/mysql@2.15.27", "", { "dependencies": { "@types/node": "*" } }, "sha512-YfWiV16IY0OeBfBCk8+hXKmdTKrKlwKN1MNKAPBu5JYxLwBEZl7QzeEpGnlZb3VMGJrrGmB84gXiH+ofs/TezA=="], - "@types/node": ["@types/node@26.6.2", "", { "dependencies": { "undici-types": "~8.9.0" } }, "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g=="], + "@types/node": ["@types/node@26.6.5", "", { "dependencies": { "undici-types": "~8.9.0" } }, "sha512-uMzsv9stDdofIZBx4UGh4Z9ZgXnGC9seRDscilBcTHAeOFk67MZg/k9bWVfO+bk4qZmG+l52hRnLwUiH2LnJTg=="], "@types/normalize-package-data": ["@types/normalize-package-data@2.4.4", "", {}, "sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA=="], @@ -3789,7 +3789,7 @@ "youch-core": ["youch-core@0.3.3", "", { "dependencies": { "@poppinss/exception": "^1.2.2", "error-stack-parser-es": "^1.0.5" } }, "sha512-ho7XuGjLaJ2hWHoK8yFnsUGy2Y5uDpqSTq1FkHLK4/oqKtyUU1AFbOOxY4IpC9f0fTLjwYbslUz0Po5BpD1wrA=="], - "zod": ["zod@4.6.5", "", {}, "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q=="], + "zod": ["zod@4.6.7", "", {}, "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg=="], "zod-to-json-schema": ["zod-to-json-schema@3.24.6", "", { "peerDependencies": { "zod": "^3.24.1" } }, "sha512-h/z3PKvcTcTetyjl1fkj79MHNEjm+HpD6NXheWjzOekY7kV+lwDYnHw+ivHkijnCSMz1yJaWBD9vu/Fcmk+vEg=="], diff --git a/packages/server/package.json b/packages/server/package.json index 268ab7af..e34bce47 100644 --- a/packages/server/package.json +++ b/packages/server/package.json @@ -48,4 +48,4 @@ "engines": { "node": ">=20.9.0" } -} \ No newline at end of file +}