Skip to content

v1.1.4 — Node.js 22 runtime

Choose a tag to compare

View all tags
@freema freema released this 22 Oct 20:16
· 3 commits to main since this release
v1.1.4
21cc945

Broken on existing data volumes — use v1.1.5. The codeforge user is UID 1001 in this image and cannot write a /data volume from v1.1.3 or older.

Security release.

  • Runtime on node:22-alpine (Node.js 22.23.4): the codeforge image ran on alpine:3.20 with Alpine's nodejs package, i.e. Node.js 20.15.1 (end-of-life), and codeforge-action on alpine:3.21's lagging package. Both now carry the Node.js security release of 2026-10-21 (CVE-2026-111497 — RCE in the Brotli decoder — plus HIGH-severity TLS hostname-verification and DNS fixes). Claude Code and Codex CLI versions are unchanged.
  • Tenant isolation, GitLab command authorization and untrusted-workspace git (#49)
  • OpenTelemetry 1.45.0 (#47)
Assets 2
Loading