remove CVE-2026-59874 and CVE-2026-59873

.tekton/on-pull-request.yaml

@@ -213,9 +213,40 @@ spec:
 
                 # ubi-minimal has no dev tools — install the essentials
                 print_banner "Installing system packages"
-                microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar
-                microdnf module enable -y nodejs:20
-                microdnf install -y nodejs npm
+                microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz libatomic
+
+                # Install Node.js 26.5.0 manually
+                print_banner "Installing Node.js 26.5.0"
+                NODE_VERSION="26.5.0"
+                NODE_ARCH="x64"
+                NODE_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz"
+
+                echo ">> Downloading Node.js ${NODE_VERSION}"
+                mkdir -p /tekton/home/nodejs
+                curl -fsSL -o /tekton/home/nodejs/node.tar.xz "$NODE_URL"
+                tar -C /tekton/home/nodejs -xJf /tekton/home/nodejs/node.tar.xz
+                rm -f /tekton/home/nodejs/node.tar.xz
+
+                export NODE_HOME="/tekton/home/nodejs/node-v${NODE_VERSION}-linux-${NODE_ARCH}"
+                export PATH="$NODE_HOME/bin:$PATH"
+
+                # CVE-2026-42338: ip-address <10.1.1 XSS (transitive via npm -> socks@2.8.7)
+                echo ">> Updating ip-address to 10.1.1"
+                (cd /tmp && \
+                 npm pack ip-address@10.1.1 && \
+                 tar -xzf ip-address-*.tgz && \
+                 rm -rf "$NODE_HOME/lib/node_modules/npm/node_modules/ip-address" && \
+                 mv package "$NODE_HOME/lib/node_modules/npm/node_modules/ip-address" && \
+                 rm -f ip-address-*.tgz)
+
+                # npm <=11.17 bundles brace-expansion <=5.0.6; upgrade to patched release
+                echo ">> Upgrading npm to 11.18.0"
+                npm install -g npm@11.18.0
+
+                echo "Node.js version:"
+                node --version
+                echo "npm version:"
+                npm --version
 
                 # Mark the workspace as safe before any tool (uv, git, etc.) touches it.
                 git config --global --add safe.directory /workspace/source