scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-31 06:56:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 245

fix(docker): bump UI_BUILD_IMAGE to node 24.22.1 (Oct 2026 security release)

Browse source 
The pinned node:24.19-alpine3.24 base predates the 2026-10-21 Node.js
security releases. The patched minimum on the 24.x line is 24.22.1.

The new digest was cross-verified against the official
node:24.22.1-alpine3.24 manifest (matching the digest quoted by other
projects that already bumped for the same advisory).

The runtime image's Wolfi-provided nodejs is pulled at build time and
needs a base-image rebuild to pick up 26.12.1; this change covers the
UI build stage that the Dockerfile pins explicitly.

Fixes #48299

Signed-off-by: inchang-ing <197932532+inchang-ing@users.noreply.github.com>
This commit is contained in:
inchang-ing 2026-10-25 20:43:06 +08:00
parent dddbaa803d
commit c0ad7c35a3
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Dockerfile
View file

@ -7,7 +7,7 @@ ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:360896efb0753a5701c
ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:360896efb0753a5701c48f860e17130c205eae5a264797aa3e7ea126ee2923a7
ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a
# Pinned by digest like the other base images; bump explicitly on Node upgrades.
ARG UI_BUILD_IMAGE=node:24.19-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43
ARG UI_BUILD_IMAGE=node:24.22.1-alpine3.24@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
# Checksum from https://www.pgbouncer.org/downloads/ (the Wolfi repo only carries 1.24.x)
ARG PGBOUNCER_VERSION=1.26.0
ARG PGBOUNCER_SHA256=afd25dd61ee6775d37b40629b87ce08736b3e6955f3057bb212e410fbf21c71d