fix(gleam-website): node 24.22.1, and a CVE scan in CI by h0ffmann · Pull Request #143 · h0ffmann/picasso

h0ffmann · 2026-10-22T07:29:24Z

What this changes

labs/gleam-website: Node.js 24.22.1. The October 2026 Node.js security release (nodejs.org, 2026-10-21) fixes 10 vulnerabilities. 4 of them are high: a Brotli decoder flaw with remote code execution (CVE-2026-111497) and TLS hostname checks that can accept the wrong server. The lab used nixpkgs' nodejs 24.21.0, which is affected. nixpkgs does not ship 24.22.1 yet (nixos-unstable 02c087f, 2026-10-20). nodejs-bin.nix takes the official nodejs.org build of 24.22.1, pinned by the sha256 of the release's SHASUMS256.txt. Only the lab's tool list gets it. An overlay of pkgs.nodejs would rebuild erlang and webkitgtk through gleam.
checks.node-version. It fails at evaluation below 24.22.1 and runs the binary in the sandbox. The scanners' databases (osv.dev, nodejs/security-wg) do not list these CVEs yet, so this check is the one that catches them today.
lab.json. nodejs leaves the headline. The card reads nixpkgs' nodejs, and that is now not the node of this shell.
.github/workflows/cve.yml. OSV-Scanner over every lock file, and is-my-node-vulnerable on the lab's node. It runs on push to main, on each pull request and every Monday. The owner asked for this workflow by name.
labs/ptbr-pdf/osv-scanner.toml. 8 advisories that the lab cannot fix, each with its reason and ignoreUntil 2027-01-22: 2 in quick-xml 0.38.4 (it comes through typst) and 6 unmaintained crates with no known flaw.

Tested

nix flake check --no-update-lock-file --print-build-logs . in labs/gleam-website: exit 0 (node-version v24.22.1, versions, smoke).
nix develop in the lab: node v24.22.1, npm 11.19.1.
nixpkgs-fmt --check, statix check, deadnix --fail: exit 0. just --list parses.
nix run nixpkgs#osv-scanner -- scan source -r .: no issues, 8 filtered with their reasons.
nix run nixpkgs#actionlint: exit 0. nix run nixpkgs#reuse -- lint: compliant, 388/388. Not run: pipx run reuse==5.0.2 lint.

What a consumer has to do

h0ffmann/ptbr-writer (.#site shell): run nix flake update gleam-website code-graph and move the forks/picasso submodule to the merge commit (just pins). Its site then builds with node 24.22.1. A pull request in ptbr-writer follows this merge.
Other consumers of labs/gleam-website (closed-source, ww3-gpu): nix flake update gleam-website. The shape of the lab does not change.
When nixpkgs ships nodejs >= 24.22.1: remove nodejs-bin.nix, use nodejs again and put it back in the headline.

Not changed

The legacy root flake.nix and dev-shell.nix use nodejs_22 (22.23.3 in nixos-unstable today, affected). AGENTS.md says not to develop the legacy root, so this pull request does not change it.

The October 2026 Node.js security release (nodejs.org/en/blog/vulnerability/ october-2026-security-releases, 2026-10-21) fixes 10 vulnerabilities, 4 of them high: a Brotli decoder out-of-bounds write with remote code execution (CVE-2026-111497) and TLS hostname checks that can accept the wrong server. 24.21.0, the nodejs of nixos-unstable on 2026-10-22, is affected; 24.22.1 has the fixes. nixpkgs does not ship 24.22.1 yet. nodejs-bin.nix takes the official nodejs.org build of 24.22.1 for x86_64-linux, aarch64-linux and aarch64-darwin, pinned by the sha256 of the release's SHASUMS256.txt (autoPatchelf on Linux). Only toolsFor gets it: an overlay of pkgs.nodejs would rebuild erlang and webkitgtk through gleam. checks.node-version fails at evaluation below 24.22.1 and runs the binary in the sandbox, because the scanners' databases (osv.dev, nodejs/security-wg) do not list these CVEs yet. nodejs leaves lab.json's headline: the card reads nixpkgs' nodejs, which is now not the node of this shell. Drop nodejs-bin.nix when nixpkgs has nodejs >= 24.22.1. Tested: nix flake check --no-update-lock-file --print-build-logs . in labs/gleam-website (exit 0: node-version v24.22.1, versions, smoke); nix develop: node v24.22.1, npm 11.19.1; nixpkgs-fmt --check, statix check, deadnix --fail (exit 0); just --list Co-Authored-By: Claude <[email protected]>

cve.yml has two jobs. osv runs OSV-Scanner over every lock file in the repository against osv.dev. node runs is-my-node-vulnerable on the node of labs/gleam-website against Node.js's own advisories. The workflow runs on push to main, so an advisory published after a merge still turns main red, and every Monday at 06:17 UTC. labs/ptbr-pdf/osv-scanner.toml lists the 8 advisories in that lab's Cargo.lock that the lab cannot fix: 2 in quick-xml 0.38.4 (RUSTSEC-2026-0194 and -0195, fixed in 0.41.0, which comes in through typst's citationberg and plist), and 6 unmaintained crates with no known flaw (bincode, paste, rustybuzz, ttf-parser, unsafe-libyaml, yaml-rust). Each entry has its reason and ignoreUntil 2027-01-22, so the scan fails again on that date. The owner asked for this workflow by name ("CVE scan no GitHub Actions" for h0ffmann/picasso), as AGENTS.md requires for a change to .github/workflows/. Tested: nix run nixpkgs#osv-scanner -- scan source -r . (No issues found, 8 filtered with their reasons); nix run nixpkgs#actionlint (exit 0); nix run nixpkgs#reuse -- lint (compliant, 388/388); [email protected] on node 24.22.1 (exit 0) Co-Authored-By: Claude <[email protected]>

h0ffmann · 2026-10-22T07:34:22Z

A second commit fixes how node is patched. With patchelf 0.19.2 (the nixpkgs of h0ffmann/ptbr-writer), the autoPatchelf build of node segfaults in the loader. This lab's nixpkgs still has patchelf 0.15.2, so the next nix flake update here would break it too. The derivation now sets the rpath and then the interpreter in two separate calls (the only order that works with 0.19.2), does not let the fixup phase touch the ELF, and runs node --version in an installCheck.

A release de segurança do Node de 2026-10-21 (#83) corrige 10 falhas, 4 altas. O dev shell usava o nodejs do nixpkgs, 24.21.0, afetada; o CI da extensão pegou 22.23.3 de "node-version: 22", também afetada; e o do plugin usava o node do runner, sem versão nos logs. O nixpkgs ainda não tem a 24.22.1. nix/nodejs-bin.nix usa o binário oficial do nodejs.org, fixado pelo sha256 do SHASUMS256.txt da release, cópia do lab do picasso (h0ffmann/picasso#143). Com o patchelf 0.19.2 deste nixpkgs, o autoPatchelf gerava um node que caía no loader; a derivação põe o rpath e depois o interpretador em duas chamadas, não deixa o fixup mexer no ELF e roda node --version no build. O extension.yml e o plugin.yml fixam a 24.22.1. just node-check, no just quality, falha abaixo das versões corrigidas (22.23.4, 24.22.1, 26.12.1) e em qualquer outra linha. O cve.yml roda o OSV-Scanner nos locks deste repositório, o node-check e o is-my-node-vulnerable na main, em cada PR e toda segunda. Refs #83 Tested: nix develop: node v24.22.1, npm 11.19.1; just node-check reprova 24.21.0, 22.23.3 e 20.19.0 e aprova 24.22.1, 22.23.4 e 26.12.1; nix run nixpkgs#osv-scanner num checkout sem submódulos (No issues found); nix run nixpkgs#actionlint; nix develop -c just quality Co-Authored-By: Claude Opus 5.5 <[email protected]>

A release de segurança do Node de 2026-10-21 (#83) corrige 10 falhas, 4 altas. O dev shell usava o nodejs do nixpkgs, 24.21.0, afetada; o CI da extensão pegou 22.23.3 de "node-version: 22", também afetada; e o do plugin usava o node do runner, sem versão nos logs. O nixpkgs ainda não tem a 24.22.1. nix/nodejs-bin.nix usa o binário oficial do nodejs.org, fixado pelo sha256 do SHASUMS256.txt da release, cópia do lab do picasso (h0ffmann/picasso#143). Com o patchelf 0.19.2 deste nixpkgs, o autoPatchelf gerava um node que caía no loader; a derivação põe o rpath e depois o interpretador em duas chamadas, não deixa o fixup mexer no ELF e roda node --version no build. O extension.yml e o plugin.yml fixam a 24.22.1. just node-check, no just quality, falha abaixo das versões corrigidas (22.23.4, 24.22.1, 26.12.1) e em qualquer outra linha. O cve.yml roda o OSV-Scanner nos locks deste repositório, o node-check e o is-my-node-vulnerable na main, em cada PR e toda segunda. Refs #83 Tested: nix develop: node v24.22.1, npm 11.19.1; just node-check reprova 24.21.0, 22.23.3 e 20.19.0 e aprova 24.22.1, 22.23.4 e 26.12.1; nix run nixpkgs#osv-scanner num checkout sem submódulos (No issues found); nix run nixpkgs#actionlint; nix develop -c just quality Co-authored-by: Claude Opus 5.5 <[email protected]>

h0ffmann and others added 2 commits October 22, 2026 04:28

h0ffmann mentioned this pull request Oct 22, 2026

Remover o JavaScript e o npm do repositório: Rust e Gleam como linguagens de primeira classe h0ffmann/ptbr-writer#85

Open

7 tasks

h0ffmann merged commit 5da5237 into main Oct 22, 2026
2 checks passed

This was referenced Oct 22, 2026

fix(node): node 24.22.1 no dev shell e no CI, e o scan de CVE h0ffmann/ptbr-writer#86

Merged

chore(node): a release de segurança do Node de 2026-10-21 (Brotli, TLS); o dev shell está na v24.21.0 h0ffmann/ptbr-writer#83

Open

h0ffmann mentioned this pull request Oct 22, 2026

fix(node): o shell do site no Node 24.22.1, pelo picasso 5da5237 h0ffmann/ptbr-writer#90

Merged

Navigation Menu

Repository navigation

fix(gleam-website): node 24.22.1, and a CVE scan in CI - #143

fix(gleam-website): node 24.22.1, and a CVE scan in CI#143
h0ffmann merged 2 commits into
mainfrom
fix/gleam-website-node-24.22.1

h0ffmann commented Oct 22, 2026

Uh oh!

Uh oh!

h0ffmann commented Oct 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

h0ffmann commented Oct 22, 2026

What this changes

Tested

What a consumer has to do

Not changed

Uh oh!

Uh oh!

h0ffmann commented Oct 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant