From dee15f7eb394f91c3e23b157d1ba2caeab711b54 Mon Sep 17 00:00:00 2001 From: John Lin Date: Thu, 22 Oct 2026 20:23:26 +0800 Subject: [PATCH 1/2] fix(security): inherit JDK CVE-2026-91403 mitigation --- .github/workflows/build.yml | 3 ++- Dockerfile | 4 ++-- README.md | 2 +- versions/versions.json | 30 +++++++++++++++--------------- 4 files changed, 20 insertions(+), 19 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 2acbc74..ef126b3 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -102,6 +102,7 @@ jobs: context: . file: ./Dockerfile platforms: linux/amd64,linux/arm64 + pull: true push: true tags: ${{ steps.meta.outputs.tags }} build-args: | @@ -171,7 +172,7 @@ jobs: ```bash docker build \ --build-arg NODE_VERSION=22.23.4 \ - --build-arg MAVEN_TAG=3.9.15-jdk21.0.10-noble \ + --build-arg MAVEN_TAG=3.9.15-jdk21.0.12.1-noble \ -t my-node:22-jdk21 . ``` diff --git a/Dockerfile b/Dockerfile index 2a553bd..10895e5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,10 +1,10 @@ # Parameterized Node + Maven + JDK Dockerfile # # Build example: -# docker build --build-arg NODE_VERSION=22.23.4 --build-arg MAVEN_TAG=3.9.15-jdk21.0.10-noble . +# docker build --build-arg NODE_VERSION=22.23.4 --build-arg MAVEN_TAG=3.9.15-jdk21.0.12.1-noble . ARG NODE_VERSION=22.23.4 -ARG MAVEN_TAG=3.9.15-jdk21.0.10-noble +ARG MAVEN_TAG=3.9.15-jdk21.0.12.1-noble FROM docker.io/library/node:${NODE_VERSION}-slim AS node diff --git a/README.md b/README.md index 8f2d3a2..0fc5ae3 100644 --- a/README.md +++ b/README.md @@ -39,7 +39,7 @@ docker run -it ringcentral/node:22-jdk21 node --version ```bash docker build \ --build-arg NODE_VERSION=22.23.4 \ - --build-arg MAVEN_TAG=3.9.15-jdk21.0.10-noble \ + --build-arg MAVEN_TAG=3.9.15-jdk21.0.12.1-noble \ -t my-node:22-jdk21 . ``` diff --git a/versions/versions.json b/versions/versions.json index 29c252c..c37e9ef 100644 --- a/versions/versions.json +++ b/versions/versions.json @@ -5,7 +5,7 @@ "node_version": "22.23.4", "node_major": "22", "jdk_version": "8", - "maven_tag": "3.8.9-jdk8u482-noble", + "maven_tag": "3.8.9-jdk8u504-noble", "is_latest": false }, { @@ -13,7 +13,7 @@ "node_version": "24.22.1", "node_major": "24", "jdk_version": "8", - "maven_tag": "3.8.9-jdk8u482-noble", + "maven_tag": "3.8.9-jdk8u504-noble", "is_latest": false }, { @@ -21,7 +21,7 @@ "node_version": "26.12.1", "node_major": "26", "jdk_version": "8", - "maven_tag": "3.8.9-jdk8u482-noble", + "maven_tag": "3.8.9-jdk8u504-noble", "is_latest": false }, { @@ -29,7 +29,7 @@ "node_version": "22.23.4", "node_major": "22", "jdk_version": "11", - "maven_tag": "3.9.15-jdk11.0.30-noble", + "maven_tag": "3.9.15-jdk11.0.32.1-noble", "is_latest": false }, { @@ -37,7 +37,7 @@ "node_version": "24.22.1", "node_major": "24", "jdk_version": "11", - "maven_tag": "3.9.15-jdk11.0.30-noble", + "maven_tag": "3.9.15-jdk11.0.32.1-noble", "is_latest": false }, { @@ -45,7 +45,7 @@ "node_version": "26.12.1", "node_major": "26", "jdk_version": "11", - "maven_tag": "3.9.15-jdk11.0.30-noble", + "maven_tag": "3.9.15-jdk11.0.32.1-noble", "is_latest": false }, { @@ -53,7 +53,7 @@ "node_version": "22.23.4", "node_major": "22", "jdk_version": "17", - "maven_tag": "3.9.15-jdk17.0.18-noble", + "maven_tag": "3.9.15-jdk17.0.20.1-noble", "is_latest": false }, { @@ -61,7 +61,7 @@ "node_version": "24.22.1", "node_major": "24", "jdk_version": "17", - "maven_tag": "3.9.15-jdk17.0.18-noble", + "maven_tag": "3.9.15-jdk17.0.20.1-noble", "is_latest": false }, { @@ -69,7 +69,7 @@ "node_version": "26.12.1", "node_major": "26", "jdk_version": "17", - "maven_tag": "3.9.15-jdk17.0.18-noble", + "maven_tag": "3.9.15-jdk17.0.20.1-noble", "is_latest": false }, { @@ -77,7 +77,7 @@ "node_version": "22.23.4", "node_major": "22", "jdk_version": "21", - "maven_tag": "3.9.15-jdk21.0.10-noble", + "maven_tag": "3.9.15-jdk21.0.12.1-noble", "is_latest": true }, { @@ -85,7 +85,7 @@ "node_version": "24.22.1", "node_major": "24", "jdk_version": "21", - "maven_tag": "3.9.15-jdk21.0.10-noble", + "maven_tag": "3.9.15-jdk21.0.12.1-noble", "is_latest": false }, { @@ -93,7 +93,7 @@ "node_version": "26.12.1", "node_major": "26", "jdk_version": "21", - "maven_tag": "3.9.15-jdk21.0.10-noble", + "maven_tag": "3.9.15-jdk21.0.12.1-noble", "is_latest": false }, { @@ -101,7 +101,7 @@ "node_version": "22.23.4", "node_major": "22", "jdk_version": "25", - "maven_tag": "3.9.15-jdk25.0.2-noble", + "maven_tag": "3.9.15-jdk25.0.4.1-noble", "is_latest": false }, { @@ -109,7 +109,7 @@ "node_version": "24.22.1", "node_major": "24", "jdk_version": "25", - "maven_tag": "3.9.15-jdk25.0.2-noble", + "maven_tag": "3.9.15-jdk25.0.4.1-noble", "is_latest": false }, { @@ -117,7 +117,7 @@ "node_version": "26.12.1", "node_major": "26", "jdk_version": "25", - "maven_tag": "3.9.15-jdk25.0.2-noble", + "maven_tag": "3.9.15-jdk25.0.4.1-noble", "is_latest": false } ], From ec41685af12f94f2eb72a7ff95591fa34dffb6e5 Mon Sep 17 00:00:00 2001 From: John Lin Date: Thu, 22 Oct 2026 20:41:07 +0800 Subject: [PATCH 2/2] ci: validate upgrade pull requests before publication --- .github/workflows/build.yml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ef126b3..b381eb0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -8,6 +8,11 @@ on: - 'Dockerfile' - 'versions/**' - '.github/workflows/build.yml' + pull_request: + paths: + - 'Dockerfile' + - 'versions/**' + - '.github/workflows/build.yml' workflow_dispatch: inputs: version: @@ -59,12 +64,14 @@ jobs: uses: docker/setup-buildx-action@v3 - name: Login to Docker Hub + if: github.ref == 'refs/heads/master' && github.event_name != 'pull_request' uses: docker/login-action@v3 with: username: ${{ secrets.DOCKER_HUB_USERNAME }} password: ${{ secrets.DOCKER_HUB_PASSWORD }} - name: Login to GitHub Container Registry + if: github.ref == 'refs/heads/master' && github.event_name != 'pull_request' uses: docker/login-action@v3 with: registry: ghcr.io @@ -103,7 +110,7 @@ jobs: file: ./Dockerfile platforms: linux/amd64,linux/arm64 pull: true - push: true + push: ${{ github.ref == 'refs/heads/master' && github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }} build-args: | NODE_VERSION=${{ matrix.node_version }} @@ -112,7 +119,7 @@ jobs: cache-to: type=gha,mode=max,scope=${{ matrix.name }} - name: Run Trivy vulnerability scanner - if: steps.build.outcome == 'success' + if: steps.build.outcome == 'success' && github.ref == 'refs/heads/master' && github.event_name != 'pull_request' uses: aquasecurity/trivy-action@master with: image-ref: ${{ env.DOCKER_HUB_IMAGE }}:${{ matrix.node_version }}-jdk${{ matrix.jdk_version }} @@ -122,12 +129,13 @@ jobs: - name: Upload Trivy scan results to GitHub Security tab uses: github/codeql-action/upload-sarif@v4 - if: steps.build.outcome == 'success' + if: steps.build.outcome == 'success' && github.ref == 'refs/heads/master' && github.event_name != 'pull_request' with: sarif_file: 'trivy-results.sarif' update-readme: needs: build + if: github.ref == 'refs/heads/master' && github.event_name != 'pull_request' runs-on: ubuntu-latest permissions: contents: write