fix(security): Node 22.23.4 base image, Next.js 15.5.28 and sharp 0.35.5

Closed
JI
7d ago
+236-191

Closes #473.

The published self-hosted image (v1.9.8/latest) and a rebuild of current main are both still exposed to the October 2026 Node.js and Next.js security releases. This PR fixes the three gaps described in #473.

Changes

BeforeAfterWhy
docker/Dockerfile basenode:22-alpine3.20 (Node 22.16.0, tag no longer updated)node:22-alpine3.23 (Node 22.23.4)CVE-2026-111497 (Brotli decoder RCE) and the rest of the 21 Oct 2026 Node.js release are fixed in 22.23.4. #472 raises engines/CI but not the image, so the image would have stayed on 22.16.0.
next (apps/web, apps/marketing)15.5.2715.5.2814 Oct 2026 Next.js release: image optimization RCE with SVG (GHSA-2464-fhr4-w9xw), Server Actions DoS (GHSA-p3m5-59mp-jv5r). 15.5.28 is now 10 days old, past the min-release-age window.
sharp0.34.50.35.5 (override)next@15.5.28 accepts ^0.34.3 || ^0.35.5, so the lockfile otherwise keeps 0.34.5. 0.35.5 is the version the image-optimization advisory names. The override is scoped to >=0.34.0 <0.35.5 and added in both pnpm-workspace.yaml and package.json, following the existing sync comment.

pnpm-lock.yaml was regenerated with the pinned pnpm@11.11.0.

Verified

  • docker build -f docker/Dockerfile . succeeds.
  • In the built image: node -v → v22.23.4, next 15.5.28, sharp 0.35.5.
  • sharp's native binary loads and renders a PNG on Alpine 3.23 (libvips 8.18.7).
  • I did not run the full app (the entrypoint runs Prisma migrations and needs a database), so a quick check against a real deployment is still worth doing.

Once merged, cutting a release would get these fixes to self-hosters, who are still on Next.js 15.5.18 and Node 22.16.0 in v1.9.8.

🤖 Generated with Claude Code

Summary by cubic

Closes #473 by patching the three October 2026 security gaps in the self-hosted image: Node.js, Next.js, and sharp.

  • Docker base: node:22-alpine3.20 (Node 22.16.0, a tag that stopped updating) → node:22-alpine3.23 (Node 22.23.4). Fixes CVE-2026-111497 (Brotli decoder RCE) and the rest of the 21 Oct 2026 Node.js release.
  • Next.js 15.5.27 → 15.5.28 in apps/web and apps/marketing. Fixes the 14 Oct 2026 release: image optimization RCE with SVG (GHSA-2464-fhr4-w9xw) and Server Actions DoS (GHSA-p3m5-59mp-jv5r).
  • sharp 0.34.5 → 0.35.5 via a pnpm override scoped to >=0.34.0 <0.35.5, added in pnpm-workspace.yaml and package.json. Without it, next 15.5.28's range (^0.34.3 || ^0.35.5) keeps the lockfile on 0.34.5, below the version the advisory names.

The image builds and verified node v22.23.4, next 15.5.28, sharp 0.35.5 (native binary loads and renders a PNG on Alpine 3.23). The full app wasn't run since the entrypoint needs a database for Prisma migrations. Cutting a release after merge would get these fixes to self-hosters on v1.9.8 (Next.js 15.5.18, Node 22.16.0).

Summary by CodeRabbit

  • Chores
    • Updated the framework used by the marketing site and web app.
    • Updated the application’s container base image.
    • Updated image-processing package version constraints across the workspace. These maintenance updates may improve compatibility and reliability; no user-facing features or behavior changes are noted.