elynch303 opened a new pull request, #9251:
URL: https://github.com/apache/devlake/pull/9251
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
### Summary
Bumps the Volta Node pin in `config-ui/package.json` from `24.19.0` to
`24.22.1`.
24.19.0 predates the [October 21, 2026 Node.js security
release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases),
which fixes 10 CVEs, 4 of them High:
- CVE-2026-111497: Brotli decoder out-of-bounds write (RCE)
- CVE-2026-105483 / CVE-2026-106069: TLS hostname-check bypasses
- CVE-2026-105482: `dns.resolve` truncates names at a NUL character
24.22.1 is the patched 24.x LTS. This is a one-line change. The Docker
builder (`node:24-bookworm-slim`) and the `config-ui.yml` workflow
(`node-version: '24'`) float on the 24 line, so they already pick up 24.22.1.
Only the Volta pin, used for local development, was behind.
### Does this close any open issues?
No open issue tracks this.
### Screenshots
N/A, no UI change.
### Other Information
Verified locally in `node:24.22.1-alpine3.23`, running the same steps as the
`config-ui` workflow:
- `yarn install --immutable`: succeeds, `yarn.lock` unchanged
- `yarn tsc`: passes
- `yarn lint`: 0 errors (the 17 existing warnings are in files this PR does
not touch)
- `yarn build`: succeeds
The commit message matches the `lint-commit-message` pattern. No new files,
so the ASF header check is not affected.
Tests and docs: no test changes are needed for a version pin. No docs need
updating: neither this repo nor the Developer Setup guide in
`apache/devlake-website` mentions a Node version.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
