fix(security): upgrade Node.js 22 runtime - #8858
Conversation
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughUpdated Node.js from 22.23.1 to 22.23.2. Refreshed archive checksums and replaced pinned ChangesNode.js and image pin refresh
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 8bcafa1 in the TypeScript / code-coverage/cliThe overall coverage in commit 8bcafa1 in the Show a code coverage summary of the most impacted files.
Updated |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/patch-bundled-npm-tar.mts`:
- Line 42: Add agents/langchain-deepagents-code/Dockerfile.base to the
pinnedBaseSources contract used by the npm-tar remediation validation, ensuring
its Node 22 base-image pin is checked alongside the existing root and Hermes
sources.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: fc830a00-b1a1-474f-89eb-c46690a58dd2
📒 Files selected for processing (19)
.github/actions/ci-reviewed-npm-audit/action.yaml.github/workflows/candidate-compatibility.yaml.github/workflows/e2e.yamlDockerfileDockerfile.baseagents/langchain-deepagents-code/Dockerfile.baseci/reviewed-npm-audit.jsonscripts/patch-bundled-npm-tar.mtstest/e2e/live/openclaw-plugin-runtime-exdev.test.tstest/e2e/live/openshell-gateway-auth-source-contract-helpers.tstest/e2e/support/openclaw-plugin-runtime-exdev-workflow-boundary.test.tstest/e2e/support/openshell-gateway-auth-contract-workflow-boundary.test.tstest/openclaw-real-patched-dist-harness.test.tstest/platform-vitest-main-workflow.test.tstest/reviewed-npm-audit-workflow.test.tstools/e2e/cli-artifact-workflow-boundary.mtstools/e2e/openclaw-plugin-runtime-exdev-workflow-boundary.mtstools/e2e/openshell-gateway-auth-contract-workflow-boundary.mtstools/wsl/ci-helper.ps1
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
1 terminology difference from the second opinionAdvisory only. These are normalized differences from the primary terminology receipt.
2 additional E2E selections from the second opinionAdvisory only. The primary lane did not select these E2E jobs or targets.
Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests. 2 semantic terminology decisionsTerminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.
E2E guidanceAdvisory only. A maintainer can dispatch the default E2E suite for the commit under review. Recommended E2E: None Manual-only E2E: This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
|
Addressed the review finding in 03ea1ee: the npm-tar base-image contract now also covers the Deep Agents Code Node.js 22 Dockerfile. The focused contract test (13 tests) and repository checks pass. |
cv
left a comment
cv
left a comment
There was a problem hiding this comment.
test/node-tar-dockerfile-contract.test.ts:51-63 concatenates all three base Dockerfiles and only checks that each allowlisted image appears somewhere. Because Dockerfile.base and the Deep Agents base currently share the Node.js 22 digest, changing only agents/langchain-deepagents-code/Dockerfile.base to an unlisted digest still passes this assertion. This can let Deep Agents ship an unreviewed bundled npm tar tree after a future base update. Assert that every relevant unique Node base reference from each managed base Dockerfile belongs to NODE_BASES_REQUIRING_BUNDLED_NPM_TAR_PATCH, preferably by comparing sets. Add regression evidence that an isolated Deep Agents digest change to an unlisted value fails the contract.
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
|
Addressed the maintainer finding in 7e0cbc5. The contract now validates each managed base Dockerfile independently against the reviewed Node base set, verifies the complete observed set, and includes a negative regression proving an isolated unreviewed Deep Agents Code digest is rejected. The focused test passes all 14 assertions, and the source-shape security gate passes. |
The latest PR commit fixes the allowlist contract. The test now validates each managed Dockerfile and rejects an isolated unreviewed digest. Dismissing this review before a full current-commit review.
…-22-23-2 # Conflicts: # tools/e2e/cli-artifact-workflow-boundary.mts
|
Refreshed onto current |
wscurran
added
area: ci
4 participants
Summary
Upgrade the managed OpenClaw and Deep Agents Code Node.js 22 runtime from 22.23.1 to the official 22.23.2 security release. Keep the production image, reviewed audit environment, WSL bootstrap, CI, E2E fixtures, and tests on the same verified runtime.
Changes
node:22-trixie-slimto the multi-architecture digest for Node.js 22.23.2.Type of Change
Quality Gates
Documentation Writer Review
no-docs-neededDGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run validate:prpassed after refreshingorigin/mainwhen hooks were skipped or unavailablenpm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result:npm run docsbuilds without warnings (doc changes only)Signed-off-by: Senthil Ravichandran senthilr@nvidia.com
Summary by CodeRabbit
Maintenance
Security
Tests