[jiaweing]

Closes #473.

The published self-hosted image (v1.9.8/latest) and a rebuild of current main are both still exposed to the October 2026 Node.js and Next.js security releases. This PR fixes the three gaps described in #473.

Changes

	Before	After	Why
docker/Dockerfile base	node:22-alpine3.20 (Node 22.16.0, tag no longer updated)	node:22-alpine3.23 (Node 22.23.4)	CVE-2026-111497 (Brotli decoder RCE) and the rest of the 21 Oct 2026 Node.js release are fixed in 22.23.4. #472 raises engines/CI but not the image, so the image would have stayed on 22.16.0.
next (apps/web, apps/marketing)	15.5.27	15.5.28	14 Oct 2026 Next.js release: image optimization RCE with SVG (GHSA-2464-fhr4-w9xw), Server Actions DoS (GHSA-p3m5-59mp-jv5r). 15.5.28 is now 10 days old, past the min-release-age window.
sharp	0.34.5	0.35.5 (override)	[email protected] accepts ^0.34.3 || ^0.35.5, so the lockfile otherwise keeps 0.34.5. 0.35.5 is the version the image-optimization advisory names. The override is scoped to >=0.34.0 <0.35.5 and added in both pnpm-workspace.yaml and package.json, following the existing sync comment.

pnpm-lock.yaml was regenerated with the pinned [email protected].

Verified

• docker build -f docker/Dockerfile . succeeds.
• In the built image: node -v → v22.23.4, next 15.5.28, sharp 0.35.5.
• sharp's native binary loads and renders a PNG on Alpine 3.23 (libvips 8.18.7).
• I did not run the full app (the entrypoint runs Prisma migrations and needs a database), so a quick check against a real deployment is still worth doing.

Once merged, cutting a release would get these fixes to self-hosters, who are still on Next.js 15.5.18 and Node 22.16.0 in v1.9.8.

🤖 Generated with Claude Code

---

Summary by cubic

Closes #473 by patching the three October 2026 security gaps in the self-hosted image: Node.js, Next.js, and sharp.

• Docker base: node:22-alpine3.20 (Node 22.16.0, a tag that stopped updating) → node:22-alpine3.23 (Node 22.23.4). Fixes CVE-2026-111497 (Brotli decoder RCE) and the rest of the 21 Oct 2026 Node.js release.
• Next.js 15.5.27 → 15.5.28 in apps/web and apps/marketing. Fixes the 14 Oct 2026 release: image optimization RCE with SVG (GHSA-2464-fhr4-w9xw) and Server Actions DoS (GHSA-p3m5-59mp-jv5r).
• sharp 0.34.5 → 0.35.5 via a pnpm override scoped to >=0.34.0 <0.35.5, added in pnpm-workspace.yaml and package.json. Without it, next 15.5.28's range (^0.34.3 || ^0.35.5) keeps the lockfile on 0.34.5, below the version the advisory names.

The image builds and verified node v22.23.4, next 15.5.28, sharp 0.35.5 (native binary loads and renders a PNG on Alpine 3.23). The full app wasn't run since the entrypoint needs a database for Prisma migrations. Cutting a release after merge would get these fixes to self-hosters on v1.9.8 (Next.js 15.5.18, Node 22.16.0).

^{Written for commit a7239ad. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • Updated the framework used by the marketing site and web app.
  • Updated the application’s container base image.
  • Updated image-processing package version constraints across the workspace. These maintenance updates may improve compatibility and reliability; no user-facing features or behavior changes are noted.

[vercel]

Someone is attempting to deploy a commit to the kmkoushik's projects Team on Vercel.

A member of the Team first needs to authorize it.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-24T07:39:39.145795Z We couldn’t complete this review. Comment @codex review to try again.	a7239ad	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d777f2c4-822e-4105-aa56-e2dd52bf5f4a

Commits

Reviewing files that changed from the base of the PR and between 7634811 and a7239ad.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 5

• apps/marketing/package.json
• apps/web/package.json
• docker/Dockerfile
• package.json
• pnpm-workspace.yaml

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

Both applications now use Next.js 15.5.28. The package configuration adds an override that resolves specified sharp versions to 0.35.5. The Docker base image changes from node:22-alpine3.20 to node:22-alpine3.23.

Suggested reviewers: kmkoushik

Priority: High

Change: Bug fix · Severity of issue fixed: High

Merge Risk: Minimal · up to a7239

No supported merge-blocking risk remains in the reviewed changes.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the security updates to the Node base image, Next.js, and sharp. These changes match the main pull request objectives.
Linked Issues check		For directly linked issue #473, the PR changes docker/Dockerfile to node:22-alpine3.23 and reports Node v22.23.4 in the built image. It updates next to 15.5.28 in both apps/web and `apps/m…
Out of Scope Changes check		The reviewed changes stay within issue #473. The Docker base-image update and Next.js updates address the stated runtime and framework vulnerabilities. The sharp override supports the related image-…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Linked Issues check

Explanation

For directly linked issue #473, the PR changes docker/Dockerfile to node:22-alpine3.23 and reports Node v22.23.4 in the built image. It updates next to 15.5.28 in both apps/web and apps/marketing. It also pins vulnerable sharp ranges to 0.35.5 and reports a successful image build and native image-processing check. The release request in #473 is a non-coding task and does not add a coding requirement.

Full details: Out of Scope Changes check

Explanation

The reviewed changes stay within issue #473. The Docker base-image update and Next.js updates address the stated runtime and framework vulnerabilities. The sharp override supports the related image-optimization security fix. The package-manager configuration changes and reported build checks support these updates. No unrelated change is demonstrated.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (5 skipped: 5 unsupported.)

Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

apps/marketing/package.json

ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.

apps/web/package.json

ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.

package.json

ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[KMKoushik]

Thanks a lot @jiaweing, this was a clear and well-researched write-up. Your changes (the node:22-alpine3.23 base image, Next.js 15.5.28 and the sharp 0.35.5 pin) landed in #470, which merged with you credited as co-author, and are now live on cloud. Closing this one as covered. A release for the self-hosted image is next.