From 9c3c892837e02aed06b9c9bcc5d8b1054f60dd12 Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Mon, 13 Jul 2026 12:24:34 +0300 Subject: [PATCH 01/14] remove CVE-2026-59874 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 46b40350b..afa504562 100644 --- a/Dockerfile +++ b/Dockerfile @@ -55,7 +55,7 @@ RUN curl -L -X GET https://go.dev/dl/go1.24.1.linux-amd64.tar.gz -o /tmp/go1.24. ENV GOTOOLCHAIN=auto # --- Node.js 25.2.0 and npm 11.6.2 --- -ARG NODE_VERSION=25.2.0 +ARG NODE_VERSION=26.4.0 RUN curl -fsSL -o /tmp/node.tar.xz \ "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \ && mkdir -p /opt/nodejs \ From c899acdbf26a1ae6c393228b7d9f5789b573ecdc Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Wed, 15 Jul 2026 14:12:55 +0300 Subject: [PATCH 02/14] update node version --- .tekton/on-pull-request.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index 39a70dc18..85e50bf95 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -214,7 +214,7 @@ spec: # ubi-minimal has no dev tools — install the essentials print_banner "Installing system packages" microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar - microdnf module enable -y nodejs:20 + microdnf module enable -y nodejs:26 microdnf install -y nodejs npm # Mark the workspace as safe before any tool (uv, git, etc.) touches it. From d9d28c5a6cd6df7886c5edae9aca0629f436c800 Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Thu, 16 Jul 2026 00:17:45 +0300 Subject: [PATCH 03/14] Update node version to 26.4 --- .tekton/on-pull-request.yaml | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index 85e50bf95..09f016fc9 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -213,9 +213,27 @@ spec: # ubi-minimal has no dev tools — install the essentials print_banner "Installing system packages" - microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar - microdnf module enable -y nodejs:26 - microdnf install -y nodejs npm + microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz + + # Install Node.js 26.4.0 manually + print_banner "Installing Node.js 26.4.0" + NODE_VERSION="26.4.0" + NODE_ARCH="x64" + NODE_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" + + echo ">> Downloading Node.js ${NODE_VERSION}" + mkdir -p /tekton/home/nodejs + curl -fsSL -o /tekton/home/nodejs/node.tar.xz "$NODE_URL" + tar -C /tekton/home/nodejs -xJf /tekton/home/nodejs/node.tar.xz + rm -f /tekton/home/nodejs/node.tar.xz + + export NODE_HOME="/tekton/home/nodejs/node-v${NODE_VERSION}-linux-${NODE_ARCH}" + export PATH="$NODE_HOME/bin:$PATH" + + echo "Node.js version:" + node --version + echo "npm version:" + npm --version # Mark the workspace as safe before any tool (uv, git, etc.) touches it. git config --global --add safe.directory /workspace/source From adb983a48b85ce910e8bd7eddcaeafd7b02bf67d Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Thu, 16 Jul 2026 00:21:06 +0300 Subject: [PATCH 04/14] Update node version to 26.4 --- .tekton/on-pull-request.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index 09f016fc9..761430d78 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -213,7 +213,7 @@ spec: # ubi-minimal has no dev tools — install the essentials print_banner "Installing system packages" - microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz + microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz libatomic # Install Node.js 26.4.0 manually print_banner "Installing Node.js 26.4.0" From 6ccada4a2ed97b61373458c4c2adaeddb5ae7e1e Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Tue, 21 Jul 2026 05:01:46 +0300 Subject: [PATCH 05/14] fix CVE-2026-59874 --- .tekton/on-pull-request.yaml | 24 ++++++++---------------- Dockerfile | 6 +++++- 2 files changed, 13 insertions(+), 17 deletions(-) diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index 761430d78..684a9acac 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -213,22 +213,14 @@ spec: # ubi-minimal has no dev tools — install the essentials print_banner "Installing system packages" - microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz libatomic - - # Install Node.js 26.4.0 manually - print_banner "Installing Node.js 26.4.0" - NODE_VERSION="26.4.0" - NODE_ARCH="x64" - NODE_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" - - echo ">> Downloading Node.js ${NODE_VERSION}" - mkdir -p /tekton/home/nodejs - curl -fsSL -o /tekton/home/nodejs/node.tar.xz "$NODE_URL" - tar -C /tekton/home/nodejs -xJf /tekton/home/nodejs/node.tar.xz - rm -f /tekton/home/nodejs/node.tar.xz - - export NODE_HOME="/tekton/home/nodejs/node-v${NODE_VERSION}-linux-${NODE_ARCH}" - export PATH="$NODE_HOME/bin:$PATH" + microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar + microdnf module enable -y nodejs:20 + microdnf install -y nodejs npm + + # Override bundled node-tar to fix CVE-2026-59874 + echo ">> Updating node-tar to 7.5.18" + cd "$NODE_HOME/lib/node_modules/npm" + npm install node-tar@7.5.18 echo "Node.js version:" node --version diff --git a/Dockerfile b/Dockerfile index afa504562..1160a05fa 100644 --- a/Dockerfile +++ b/Dockerfile @@ -55,7 +55,7 @@ RUN curl -L -X GET https://go.dev/dl/go1.24.1.linux-amd64.tar.gz -o /tmp/go1.24. ENV GOTOOLCHAIN=auto # --- Node.js 25.2.0 and npm 11.6.2 --- -ARG NODE_VERSION=26.4.0 +ARG NODE_VERSION=25.2.0 RUN curl -fsSL -o /tmp/node.tar.xz \ "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \ && mkdir -p /opt/nodejs \ @@ -63,6 +63,10 @@ RUN curl -fsSL -o /tmp/node.tar.xz \ && rm -f /tmp/node.tar.xz ENV PATH="/opt/nodejs/bin:${PATH}" +# Override bundled node-tar to fix CVE-2026-59874 +RUN cd /opt/nodejs/lib/node_modules/npm && \ + npm install node-tar@7.5.18 + # Verify Node.js and npm installation RUN node --version && npm --version From 3988826568ebc30e40a3e7d220b54ee86e8b705f Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Tue, 21 Jul 2026 11:33:27 +0300 Subject: [PATCH 06/14] fix node path --- .tekton/on-pull-request.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index f4252b9ca..662a94b94 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -217,16 +217,16 @@ spec: microdnf module enable -y nodejs:20 microdnf install -y nodejs npm - # Override bundled node-tar to fix CVE-2026-59874 - echo ">> Updating node-tar to 7.5.18" - cd "$NODE_HOME/lib/node_modules/npm" - npm install node-tar@7.5.18 - echo "Node.js version:" node --version echo "npm version:" npm --version + # Override bundled node-tar to fix CVE-2026-59874 + echo ">> Updating node-tar to 7.5.18" + cd /usr/lib/node_modules/npm + npm install node-tar@7.5.18 + # Mark the workspace as safe before any tool (uv, git, etc.) touches it. git config --global --add safe.directory /workspace/source From 33b5093f8dda420affa552a0eeb8e3b564b29ac7 Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Tue, 21 Jul 2026 11:42:49 +0300 Subject: [PATCH 07/14] fix --- .tekton/on-pull-request.yaml | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index 662a94b94..977c3225a 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -213,9 +213,22 @@ spec: # ubi-minimal has no dev tools — install the essentials print_banner "Installing system packages" - microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar - microdnf module enable -y nodejs:20 - microdnf install -y nodejs npm + microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz libatomic + + # Install Node.js 25.2.0 manually + print_banner "Installing Node.js 25.2.0" + NODE_VERSION="25.2.0" + NODE_ARCH="x64" + NODE_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" + + echo ">> Downloading Node.js ${NODE_VERSION}" + mkdir -p /tekton/home/nodejs + curl -fsSL -o /tekton/home/nodejs/node.tar.xz "$NODE_URL" + tar -C /tekton/home/nodejs -xJf /tekton/home/nodejs/node.tar.xz + rm -f /tekton/home/nodejs/node.tar.xz + + export NODE_HOME="/tekton/home/nodejs/node-v${NODE_VERSION}-linux-${NODE_ARCH}" + export PATH="$NODE_HOME/bin:$PATH" echo "Node.js version:" node --version @@ -224,7 +237,7 @@ spec: # Override bundled node-tar to fix CVE-2026-59874 echo ">> Updating node-tar to 7.5.18" - cd /usr/lib/node_modules/npm + cd "$NODE_HOME/lib/node_modules/npm" npm install node-tar@7.5.18 # Mark the workspace as safe before any tool (uv, git, etc.) touches it. From 5e458d799ad8debaca2d66f8a924c62519b32205 Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Tue, 21 Jul 2026 11:54:25 +0300 Subject: [PATCH 08/14] fix --- .tekton/on-pull-request.yaml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index 977c3225a..12b0f9942 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -237,8 +237,17 @@ spec: # Override bundled node-tar to fix CVE-2026-59874 echo ">> Updating node-tar to 7.5.18" - cd "$NODE_HOME/lib/node_modules/npm" - npm install node-tar@7.5.18 + TAR_DIR="$NODE_HOME/lib/node_modules/npm/node_modules/node-tar" + echo "Backing up original node-tar..." + mv "$TAR_DIR" "${TAR_DIR}.old" + echo "Downloading node-tar@7.5.18..." + mkdir -p /tmp/node-tar-update + cd /tmp/node-tar-update + npm pack node-tar@7.5.18 + echo "Extracting to npm's node_modules..." + tar -xzf node-tar-7.5.18.tgz + mv package "$TAR_DIR" + echo "node-tar updated successfully" # Mark the workspace as safe before any tool (uv, git, etc.) touches it. git config --global --add safe.directory /workspace/source From b941d296b9fc7c0d802e1004e1d32a482a8915c4 Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Tue, 21 Jul 2026 12:05:47 +0300 Subject: [PATCH 09/14] align to dockerfile node version --- .tekton/on-pull-request.yaml | 44 ++++++++++++++++++++++-------------- 1 file changed, 27 insertions(+), 17 deletions(-) diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index 12b0f9942..ee3497b2d 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -215,9 +215,9 @@ spec: print_banner "Installing system packages" microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz libatomic - # Install Node.js 25.2.0 manually - print_banner "Installing Node.js 25.2.0" - NODE_VERSION="25.2.0" + # Install Node.js 26.5.0 manually + print_banner "Installing Node.js 26.5.0" + NODE_VERSION="26.5.0" NODE_ARCH="x64" NODE_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" @@ -230,24 +230,34 @@ spec: export NODE_HOME="/tekton/home/nodejs/node-v${NODE_VERSION}-linux-${NODE_ARCH}" export PATH="$NODE_HOME/bin:$PATH" - echo "Node.js version:" - node --version - echo "npm version:" - npm --version + # CVE-2026-42338: ip-address <10.1.1 XSS (transitive via npm -> socks@2.8.7) + echo ">> Updating ip-address to 10.1.1" + cd /tmp + npm pack ip-address@10.1.1 + tar -xzf ip-address-*.tgz + rm -rf "$NODE_HOME/lib/node_modules/npm/node_modules/ip-address" + mv package "$NODE_HOME/lib/node_modules/npm/node_modules/ip-address" + rm -f /tmp/ip-address-*.tgz + rm -rf /tmp/package # Override bundled node-tar to fix CVE-2026-59874 echo ">> Updating node-tar to 7.5.18" - TAR_DIR="$NODE_HOME/lib/node_modules/npm/node_modules/node-tar" - echo "Backing up original node-tar..." - mv "$TAR_DIR" "${TAR_DIR}.old" - echo "Downloading node-tar@7.5.18..." - mkdir -p /tmp/node-tar-update - cd /tmp/node-tar-update + cd /tmp npm pack node-tar@7.5.18 - echo "Extracting to npm's node_modules..." - tar -xzf node-tar-7.5.18.tgz - mv package "$TAR_DIR" - echo "node-tar updated successfully" + tar -xzf node-tar-*.tgz + rm -rf "$NODE_HOME/lib/node_modules/npm/node_modules/node-tar" + mv package "$NODE_HOME/lib/node_modules/npm/node_modules/node-tar" + rm -f /tmp/node-tar-*.tgz + rm -rf /tmp/package + + # npm <=11.17 bundles brace-expansion <=5.0.6; upgrade to patched release + echo ">> Upgrading npm to 11.18.0" + npm install -g npm@11.18.0 + + echo "Node.js version:" + node --version + echo "npm version:" + npm --version # Mark the workspace as safe before any tool (uv, git, etc.) touches it. git config --global --add safe.directory /workspace/source From 996c95ef32bba2d46f09a5d34ce230a2f291429b Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Tue, 21 Jul 2026 12:11:48 +0300 Subject: [PATCH 10/14] align to dockerfile node version --- .tekton/on-pull-request.yaml | 50 +++--------------------------------- Dockerfile | 6 +---- 2 files changed, 5 insertions(+), 51 deletions(-) diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index ee3497b2d..6767a730d 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -213,52 +213,10 @@ spec: # ubi-minimal has no dev tools — install the essentials print_banner "Installing system packages" - microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz libatomic - - # Install Node.js 26.5.0 manually - print_banner "Installing Node.js 26.5.0" - NODE_VERSION="26.5.0" - NODE_ARCH="x64" - NODE_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" - - echo ">> Downloading Node.js ${NODE_VERSION}" - mkdir -p /tekton/home/nodejs - curl -fsSL -o /tekton/home/nodejs/node.tar.xz "$NODE_URL" - tar -C /tekton/home/nodejs -xJf /tekton/home/nodejs/node.tar.xz - rm -f /tekton/home/nodejs/node.tar.xz - - export NODE_HOME="/tekton/home/nodejs/node-v${NODE_VERSION}-linux-${NODE_ARCH}" - export PATH="$NODE_HOME/bin:$PATH" - - # CVE-2026-42338: ip-address <10.1.1 XSS (transitive via npm -> socks@2.8.7) - echo ">> Updating ip-address to 10.1.1" - cd /tmp - npm pack ip-address@10.1.1 - tar -xzf ip-address-*.tgz - rm -rf "$NODE_HOME/lib/node_modules/npm/node_modules/ip-address" - mv package "$NODE_HOME/lib/node_modules/npm/node_modules/ip-address" - rm -f /tmp/ip-address-*.tgz - rm -rf /tmp/package - - # Override bundled node-tar to fix CVE-2026-59874 - echo ">> Updating node-tar to 7.5.18" - cd /tmp - npm pack node-tar@7.5.18 - tar -xzf node-tar-*.tgz - rm -rf "$NODE_HOME/lib/node_modules/npm/node_modules/node-tar" - mv package "$NODE_HOME/lib/node_modules/npm/node_modules/node-tar" - rm -f /tmp/node-tar-*.tgz - rm -rf /tmp/package - - # npm <=11.17 bundles brace-expansion <=5.0.6; upgrade to patched release - echo ">> Upgrading npm to 11.18.0" - npm install -g npm@11.18.0 - - echo "Node.js version:" - node --version - echo "npm version:" - npm --version - + microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar + microdnf module enable -y nodejs:26 + microdnf install -y nodejs npm + # Mark the workspace as safe before any tool (uv, git, etc.) touches it. git config --global --add safe.directory /workspace/source diff --git a/Dockerfile b/Dockerfile index b8f319e33..18afe4c5e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -71,11 +71,7 @@ RUN cd /tmp && \ rm -rf /opt/nodejs/lib/node_modules/npm/node_modules/ip-address && \ mv package /opt/nodejs/lib/node_modules/npm/node_modules/ip-address && \ rm -f /tmp/ip-address-*.tgz && \ - rm -rf /tmp/package - -# Override bundled node-tar to fix CVE-2026-59874 -RUN cd /opt/nodejs/lib/node_modules/npm && \ - npm install node-tar@7.5.18 + rm -rf /tmp/package \ # Verify Node.js and npm installation # npm <=11.17 bundles brace-expansion <=5.0.6; upgrade to patched release From 7c6b0332a0c35552c50b8dc2638ebf3e00f16f8a Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Tue, 21 Jul 2026 12:12:41 +0300 Subject: [PATCH 11/14] align to dockerfile node version --- .tekton/on-pull-request.yaml | 2 +- Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index 6767a730d..509d189ff 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -216,7 +216,7 @@ spec: microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar microdnf module enable -y nodejs:26 microdnf install -y nodejs npm - + # Mark the workspace as safe before any tool (uv, git, etc.) touches it. git config --global --add safe.directory /workspace/source diff --git a/Dockerfile b/Dockerfile index 18afe4c5e..16a709bd5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -71,7 +71,7 @@ RUN cd /tmp && \ rm -rf /opt/nodejs/lib/node_modules/npm/node_modules/ip-address && \ mv package /opt/nodejs/lib/node_modules/npm/node_modules/ip-address && \ rm -f /tmp/ip-address-*.tgz && \ - rm -rf /tmp/package \ + rm -rf /tmp/package # Verify Node.js and npm installation # npm <=11.17 bundles brace-expansion <=5.0.6; upgrade to patched release From cb4996fa78ad689ee60fbde5541899489eb09d9a Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Tue, 21 Jul 2026 12:25:42 +0300 Subject: [PATCH 12/14] align to dockerfile node version --- .tekton/on-pull-request.yaml | 38 +++++++++++++++++++++++++++++++++--- 1 file changed, 35 insertions(+), 3 deletions(-) diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index 509d189ff..7f9e044b9 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -213,9 +213,41 @@ spec: # ubi-minimal has no dev tools — install the essentials print_banner "Installing system packages" - microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar - microdnf module enable -y nodejs:26 - microdnf install -y nodejs npm + microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz libatomic + + # Install Node.js 26.5.0 manually + print_banner "Installing Node.js 26.5.0" + NODE_VERSION="26.5.0" + NODE_ARCH="x64" + NODE_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" + + echo ">> Downloading Node.js ${NODE_VERSION}" + mkdir -p /tekton/home/nodejs + curl -fsSL -o /tekton/home/nodejs/node.tar.xz "$NODE_URL" + tar -C /tekton/home/nodejs -xJf /tekton/home/nodejs/node.tar.xz + rm -f /tekton/home/nodejs/node.tar.xz + + export NODE_HOME="/tekton/home/nodejs/node-v${NODE_VERSION}-linux-${NODE_ARCH}" + export PATH="$NODE_HOME/bin:$PATH" + + # CVE-2026-42338: ip-address <10.1.1 XSS (transitive via npm -> socks@2.8.7) + echo ">> Updating ip-address to 10.1.1" + cd /tmp + npm pack ip-address@10.1.1 + tar -xzf ip-address-*.tgz + rm -rf "$NODE_HOME/lib/node_modules/npm/node_modules/ip-address" + mv package "$NODE_HOME/lib/node_modules/npm/node_modules/ip-address" + rm -f /tmp/ip-address-*.tgz + rm -rf /tmp/package + + # npm <=11.17 bundles brace-expansion <=5.0.6; upgrade to patched release + echo ">> Upgrading npm to 11.18.0" + npm install -g npm@11.18.0 + + echo "Node.js version:" + node --version + echo "npm version:" + npm --version # Mark the workspace as safe before any tool (uv, git, etc.) touches it. git config --global --add safe.directory /workspace/source From 9f8187bad302eb7a11ddc1b1ce4175e1a7ffc96d Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Tue, 21 Jul 2026 12:36:11 +0300 Subject: [PATCH 13/14] align to dockerfile node version --- .tekton/on-pull-request.yaml | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index 7f9e044b9..d057ccebc 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -215,7 +215,7 @@ spec: print_banner "Installing system packages" microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz libatomic - # Install Node.js 26.5.0 manually + # Install Node.js 26.5.0 manually (includes patched node-tar for CVE-2026-59874) print_banner "Installing Node.js 26.5.0" NODE_VERSION="26.5.0" NODE_ARCH="x64" @@ -232,13 +232,12 @@ spec: # CVE-2026-42338: ip-address <10.1.1 XSS (transitive via npm -> socks@2.8.7) echo ">> Updating ip-address to 10.1.1" - cd /tmp - npm pack ip-address@10.1.1 - tar -xzf ip-address-*.tgz - rm -rf "$NODE_HOME/lib/node_modules/npm/node_modules/ip-address" - mv package "$NODE_HOME/lib/node_modules/npm/node_modules/ip-address" - rm -f /tmp/ip-address-*.tgz - rm -rf /tmp/package + (cd /tmp && \ + npm pack ip-address@10.1.1 && \ + tar -xzf ip-address-*.tgz && \ + rm -rf "$NODE_HOME/lib/node_modules/npm/node_modules/ip-address" && \ + mv package "$NODE_HOME/lib/node_modules/npm/node_modules/ip-address" && \ + rm -f ip-address-*.tgz) # npm <=11.17 bundles brace-expansion <=5.0.6; upgrade to patched release echo ">> Upgrading npm to 11.18.0" From 8b6c5bcef3ef28b81c63b45cc470635f2f0a7129 Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Tue, 21 Jul 2026 13:16:36 +0300 Subject: [PATCH 14/14] remove comment --- .tekton/on-pull-request.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index d057ccebc..0e4d2604a 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -215,7 +215,7 @@ spec: print_banner "Installing system packages" microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz libatomic - # Install Node.js 26.5.0 manually (includes patched node-tar for CVE-2026-59874) + # Install Node.js 26.5.0 manually print_banner "Installing Node.js 26.5.0" NODE_VERSION="26.5.0" NODE_ARCH="x64"