Repository navigation
Releases
26.13.0-dev-20261109.150
ghcr.io/pair-ai-platform/node:26.13.0-dev-20261109.150
Node.js 26.13.0 (dev). Index digest sha256:5eb2cfec24b91b3f7b995201c76ca4e49851db7b2734b139d73a1315fa8dd7aa.
Tags: 26.13.0-dev-20261109.150, 26-dev, 26.13-dev, 26.13.0-dev, latest-dev.
What changed
| Package | From | To |
|---|---|---|
glibc-2.44 |
2.44-r14 | 2.44-r15 |
glibc-2.44-dev |
2.44-r14 | 2.44-r15 |
glibc-2.44-locale-posix |
2.44-r14 | 2.44-r15 |
icu79-data-full |
79.1-r1 | 79.1-r2 |
ld-linux-2.44 |
2.44-r14 | 2.44-r15 |
libcrypt1-2.44 |
2.44-r14 | 2.44-r15 |
libicu79 |
79.1-r1 | 79.1-r2 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 277.1 MB | 745.2 MB |
| aarch64 | 79 | 261.5 MB | 795.5 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r15, glibc-2.44-dev 2.44-r15, libicu79 79.1-r2, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, libuv 1.53.0-r0, nodejs-26 26.13.0-r1, npm-12 12.2.2-r0, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, pnpm-11.8 11.8.0-r5, yarn 1.22.22-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-101043 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82392 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82393 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r15 | glibc-2.44 2.44-r15 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| GHSA-3g3m-2fjr-6pw4 | Medium | glob |
13.0.6 | npm-12 12.2.2-r0 |
14.0.2 | x86_64, aarch64 |
| GHSA-g3hv-75wg-m249 | Medium | minimatch |
10.2.3 | npm-12 12.2.2-r0 |
11.0.1 | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:26.13.0-dev-20261109.150 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:26.13.0-dev-20261109.150 --repo Pair-AI-Platform/node26.13.0-dev-20261109.147
ghcr.io/pair-ai-platform/node:26.13.0-dev-20261109.147
Node.js 26.13.0 (dev). Index digest sha256:276025ca4b1a77199795b4fe47a027129b0d29abed8e50e3d0f5540f5c9313cf.
Tags: 26.13.0-dev-20261109.147, 26-dev, 26.13-dev, 26.13.0-dev, latest-dev.
What changed
| Package | From | To |
|---|---|---|
binutils |
2.47-r2 | 2.47-r3 |
gcc |
16.2.0-r2 | 16.2.0-r3 |
libatomic |
16.2.0-r2 | 16.2.0-r3 |
libgcc |
16.2.0-r2 | 16.2.0-r3 |
libgomp |
16.2.0-r2 | 16.2.0-r3 |
libquadmath |
16.2.0-r2 | 16.2.0-r3 |
libstdc++ |
16.2.0-r2 | 16.2.0-r3 |
libstdc++-dev |
16.2.0-r2 | 16.2.0-r3 |
openssf-compiler-options |
20250904-r11 | 20250904-r12 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 277.1 MB | 745.2 MB |
| aarch64 | 79 | 261.5 MB | 795.5 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r14, glibc-2.44-dev 2.44-r14, libicu79 79.1-r1, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, libuv 1.53.0-r0, nodejs-26 26.13.0-r1, npm-12 12.2.2-r0, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, pnpm-11.8 11.8.0-r5, yarn 1.22.22-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-101043 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82392 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82393 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r14 | glibc-2.44 2.44-r14 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| GHSA-3g3m-2fjr-6pw4 | Medium | glob |
13.0.6 | npm-12 12.2.2-r0 |
14.0.2 | x86_64, aarch64 |
| GHSA-g3hv-75wg-m249 | Medium | minimatch |
10.2.3 | npm-12 12.2.2-r0 |
11.0.1 | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:26.13.0-dev-20261109.147 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:26.13.0-dev-20261109.147 --repo Pair-AI-Platform/node26.13.0-20261109.150
ghcr.io/pair-ai-platform/node:26.13.0-20261109.150
Node.js 26.13.0 (runtime). Index digest sha256:f49ab6ddb39986996f908b93df9b7e8a36e02156f6d5a8142b25f0c0c5f8cdcd.
Tags: 26.13.0-20261109.150, 26, 26.13, 26.13.0, latest.
What changed
| Package | From | To |
|---|---|---|
glibc-2.44 |
2.44-r14 | 2.44-r15 |
glibc-2.44-locale-posix |
2.44-r14 | 2.44-r15 |
icu79-data-full |
79.1-r1 | 79.1-r2 |
ld-linux-2.44 |
2.44-r14 | 2.44-r15 |
libcrypt1-2.44 |
2.44-r14 | 2.44-r15 |
libicu79 |
79.1-r1 | 79.1-r2 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 27 | 59.2 MB | 156.6 MB |
| aarch64 | 27 | 56.7 MB | 154.2 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r15, libicu79 79.1-r2, libstdc++ 16.2.0-r3, libuv 1.53.0-r0, nodejs-26 26.13.0-r1, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 1 / 0 / 0 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 1 / 0 / 0 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r15 | glibc-2.44 2.44-r15 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:26.13.0-20261109.150 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:26.13.0-20261109.150 --repo Pair-AI-Platform/node26.13.0-20261109.147
ghcr.io/pair-ai-platform/node:26.13.0-20261109.147
Node.js 26.13.0 (runtime). Index digest sha256:5f77e6b134bff56eb3a0254a1f64aa1406e227bfa26e208f691e457c80fa650e.
Tags: 26.13.0-20261109.147, 26, 26.13, 26.13.0, latest.
What changed
| Package | From | To |
|---|---|---|
libgcc |
16.2.0-r2 | 16.2.0-r3 |
libstdc++ |
16.2.0-r2 | 16.2.0-r3 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 27 | 59.2 MB | 156.6 MB |
| aarch64 | 27 | 56.7 MB | 154.2 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r14, libicu79 79.1-r1, libstdc++ 16.2.0-r3, libuv 1.53.0-r0, nodejs-26 26.13.0-r1, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 1 / 0 / 0 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 1 / 0 / 0 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r14 | glibc-2.44 2.44-r14 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:26.13.0-20261109.147 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:26.13.0-20261109.147 --repo Pair-AI-Platform/node24.22.2-dev-20261109.150
ghcr.io/pair-ai-platform/node:24.22.2-dev-20261109.150
Node.js 24.22.2 (dev). Index digest sha256:ae840d8538845fe3fcbfe5d96f17353dda53ee3e2d5e15cce67dddf5a94cdb64.
Tags: 24.22.2-dev-20261109.150, 24-dev, 24.22-dev, 24.22.2-dev.
What changed
| Package | From | To |
|---|---|---|
glibc-2.44 |
2.44-r14 | 2.44-r15 |
glibc-2.44-dev |
2.44-r14 | 2.44-r15 |
glibc-2.44-locale-posix |
2.44-r14 | 2.44-r15 |
icu79-data-full |
79.1-r1 | 79.1-r2 |
ld-linux-2.44 |
2.44-r14 | 2.44-r15 |
libcrypt1-2.44 |
2.44-r14 | 2.44-r15 |
libicu79 |
79.1-r1 | 79.1-r2 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 273.6 MB | 735.5 MB |
| aarch64 | 79 | 257.7 MB | 783.3 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r15, glibc-2.44-dev 2.44-r15, libicu79 79.1-r2, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, libuv 1.53.0-r0, nodejs-24 24.22.2-r2, npm-12 12.2.2-r0, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, pnpm-11.8 11.8.0-r5, yarn 1.22.22-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-101043 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82392 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82393 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r15 | glibc-2.44 2.44-r15 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| GHSA-3g3m-2fjr-6pw4 | Medium | glob |
13.0.6 | npm-12 12.2.2-r0 |
14.0.2 | x86_64, aarch64 |
| GHSA-g3hv-75wg-m249 | Medium | minimatch |
10.2.3 | npm-12 12.2.2-r0 |
11.0.1 | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:24.22.2-dev-20261109.150 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:24.22.2-dev-20261109.150 --repo Pair-AI-Platform/node24.22.2-dev-20261109.147
ghcr.io/pair-ai-platform/node:24.22.2-dev-20261109.147
Node.js 24.22.2 (dev). Index digest sha256:2c91ff6d7709f8f6abb0baa48f0a0769320dfeb06134aab6cfb72ebdddf16798.
Tags: 24.22.2-dev-20261109.147, 24-dev, 24.22-dev, 24.22.2-dev.
What changed
| Package | From | To |
|---|---|---|
binutils |
2.47-r2 | 2.47-r3 |
gcc |
16.2.0-r2 | 16.2.0-r3 |
libatomic |
16.2.0-r2 | 16.2.0-r3 |
libgcc |
16.2.0-r2 | 16.2.0-r3 |
libgomp |
16.2.0-r2 | 16.2.0-r3 |
libquadmath |
16.2.0-r2 | 16.2.0-r3 |
libstdc++ |
16.2.0-r2 | 16.2.0-r3 |
libstdc++-dev |
16.2.0-r2 | 16.2.0-r3 |
openssf-compiler-options |
20250904-r11 | 20250904-r12 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 79 | 273.6 MB | 735.5 MB |
| aarch64 | 79 | 257.7 MB | 783.3 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r14, glibc-2.44-dev 2.44-r14, libicu79 79.1-r1, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, libuv 1.53.0-r0, nodejs-24 24.22.2-r2, npm-12 12.2.2-r0, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, pnpm-11.8 11.8.0-r5, yarn 1.22.22-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-101043 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82392 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82393 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r14 | glibc-2.44 2.44-r14 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| GHSA-3g3m-2fjr-6pw4 | Medium | glob |
13.0.6 | npm-12 12.2.2-r0 |
14.0.2 | x86_64, aarch64 |
| GHSA-g3hv-75wg-m249 | Medium | minimatch |
10.2.3 | npm-12 12.2.2-r0 |
11.0.1 | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:24.22.2-dev-20261109.147 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:24.22.2-dev-20261109.147 --repo Pair-AI-Platform/node24.22.2-20261109.150
ghcr.io/pair-ai-platform/node:24.22.2-20261109.150
Node.js 24.22.2 (runtime). Index digest sha256:83ccb968f02e16cc641e5f3f36811b3435e0d55d88d0f0ecedd2c0d1092a1ab8.
Tags: 24.22.2-20261109.150, 24, 24.22, 24.22.2.
What changed
| Package | From | To |
|---|---|---|
glibc-2.44 |
2.44-r14 | 2.44-r15 |
glibc-2.44-locale-posix |
2.44-r14 | 2.44-r15 |
icu79-data-full |
79.1-r1 | 79.1-r2 |
ld-linux-2.44 |
2.44-r14 | 2.44-r15 |
libcrypt1-2.44 |
2.44-r14 | 2.44-r15 |
libicu79 |
79.1-r1 | 79.1-r2 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 27 | 55.7 MB | 146.8 MB |
| aarch64 | 27 | 53.0 MB | 142.0 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r15, libicu79 79.1-r2, libstdc++ 16.2.0-r3, libuv 1.53.0-r0, nodejs-24 24.22.2-r2, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 1 / 0 / 0 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 1 / 0 / 0 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r15 | glibc-2.44 2.44-r15 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:24.22.2-20261109.150 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:24.22.2-20261109.150 --repo Pair-AI-Platform/node24.22.2-20261109.147
ghcr.io/pair-ai-platform/node:24.22.2-20261109.147
Node.js 24.22.2 (runtime). Index digest sha256:dd845c0a4f62d4f7bbd1b13a3e3965b2bb6d4eb728a2e12ef404234ba0bfc618.
Tags: 24.22.2-20261109.147, 24, 24.22, 24.22.2.
What changed
| Package | From | To |
|---|---|---|
libgcc |
16.2.0-r2 | 16.2.0-r3 |
libstdc++ |
16.2.0-r2 | 16.2.0-r3 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 27 | 55.7 MB | 146.8 MB |
| aarch64 | 27 | 53.0 MB | 142.0 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r14, libicu79 79.1-r1, libstdc++ 16.2.0-r3, libuv 1.53.0-r0, nodejs-24 24.22.2-r2, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 1 / 0 / 0 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 1 / 0 / 0 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r14 | glibc-2.44 2.44-r14 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:24.22.2-20261109.147 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:24.22.2-20261109.147 --repo Pair-AI-Platform/node22.23.4-dev-20261109.150
ghcr.io/pair-ai-platform/node:22.23.4-dev-20261109.150
Node.js 22.23.4 (dev). Index digest sha256:8e9960c36597d3a14782c77fbd09b9bd155e33d1269aa9f62b781933c5f8bee5.
Tags: 22.23.4-dev-20261109.150, 22-dev, 22.23-dev, 22.23.4-dev.
What changed
| Package | From | To |
|---|---|---|
glibc-2.44 |
2.44-r14 | 2.44-r15 |
glibc-2.44-dev |
2.44-r14 | 2.44-r15 |
glibc-2.44-locale-posix |
2.44-r14 | 2.44-r15 |
ld-linux-2.44 |
2.44-r14 | 2.44-r15 |
libcrypt1-2.44 |
2.44-r14 | 2.44-r15 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 75 | 283.3 MB | 789.5 MB |
| aarch64 | 75 | 268.9 MB | 838.9 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r15, glibc-2.44-dev 2.44-r15, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, nodejs-22-upstream 22.23.4-r0, npm-12 12.2.2-r0, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, pnpm-11.8 11.8.0-r5, yarn 1.22.22-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-101043 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82392 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82393 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r15 | glibc-2.44 2.44-r15 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| GHSA-3g3m-2fjr-6pw4 | Medium | glob |
13.0.6 | npm-12 12.2.2-r0 |
14.0.2 | x86_64, aarch64 |
| GHSA-g3hv-75wg-m249 | Medium | minimatch |
10.2.3 | npm-12 12.2.2-r0 |
11.0.1 | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:22.23.4-dev-20261109.150 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:22.23.4-dev-20261109.150 --repo Pair-AI-Platform/node22.23.4-dev-20261109.147
ghcr.io/pair-ai-platform/node:22.23.4-dev-20261109.147
Node.js 22.23.4 (dev). Index digest sha256:4511c1a1f4b4cabe1d3c04438255d544d941791bca1414444b15af3f024f64a3.
Tags: 22.23.4-dev-20261109.147, 22-dev, 22.23-dev, 22.23.4-dev.
What changed
| Package | From | To |
|---|---|---|
binutils |
2.47-r2 | 2.47-r3 |
gcc |
16.2.0-r2 | 16.2.0-r3 |
libatomic |
16.2.0-r2 | 16.2.0-r3 |
libgcc |
16.2.0-r2 | 16.2.0-r3 |
libgomp |
16.2.0-r2 | 16.2.0-r3 |
libquadmath |
16.2.0-r2 | 16.2.0-r3 |
libstdc++ |
16.2.0-r2 | 16.2.0-r3 |
libstdc++-dev |
16.2.0-r2 | 16.2.0-r3 |
openssf-compiler-options |
20250904-r11 | 20250904-r12 |
SBOM and size
| Architecture | Packages (SBOM) | Compressed | Installed |
|---|---|---|---|
| x86_64 | 75 | 283.3 MB | 789.5 MB |
| aarch64 | 75 | 268.9 MB | 838.8 MB |
Main components: ca-certificates-bundle 20261020-r0, glibc-2.44 2.44-r14, glibc-2.44-dev 2.44-r14, libstdc++ 16.2.0-r3, libstdc++-dev 16.2.0-r3, nodejs-22-upstream 22.23.4-r0, npm-12 12.2.2-r0, openssl-4.0-libcrypto 4.0.3-r8, openssl-4.0-libssl 4.0.3-r8, pnpm-11.8 11.8.0-r5, yarn 1.22.22-r8.
The SPDX SBOMs are attached to this release and to each image as signed attestations.
Scans
| Architecture | Hardening profile, DISA GPOS SRG (applicable rules passed) | Not applicable | Vulnerabilities (C / H / M / L) |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
| aarch64 | 85 / 91 (93.4%) | 107 | 0 / 5 / 4 / 1 |
Vulnerabilities
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-101043 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-119586 | High | sqlite-libs |
3.54.1-r0 | sqlite-libs 3.54.1-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82392 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-82393 | High | pnpm-11.8 |
11.8.0-r5 | pnpm-11.8 11.8.0-r5 |
no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 |
2.44-r14 | glibc-2.44 2.44-r14 |
no fix yet | x86_64, aarch64 |
| CVE-2025-15367 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| CVE-2026-116566 | Medium | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
| GHSA-3g3m-2fjr-6pw4 | Medium | glob |
13.0.6 | npm-12 12.2.2-r0 |
14.0.2 | x86_64, aarch64 |
| GHSA-g3hv-75wg-m249 | Medium | minimatch |
10.2.3 | npm-12 12.2.2-r0 |
11.0.1 | x86_64, aarch64 |
| CVE-2026-103995 | Low | python-3.13 |
3.13.18_git20261030-r0 | python-3.13 3.13.18_git20261030-r0 |
no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
Hardening-profile rules not passed (x86_64):
SV-203649r971535_rule: The operating system must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SV-203739r987791_rule: The operating system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-203750r958912_rule: The operating system must maintain the confidentiality and integrity of information during preparation for transmission.SV-203751r958914_rule: The operating system must maintain the confidentiality and integrity of information during reception.SV-203776r959006_rule: The operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.SV-263659r982563_rule: The operating system must include only approved trust anchors in trust stores or certificate stores managed by the organization.
Verify
cosign verify ghcr.io/pair-ai-platform/node:22.23.4-dev-20261109.147 \
--certificate-identity-regexp '^https://github.com/Pair-AI-Platform/node/.github/workflows/build.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/pair-ai-platform/node:22.23.4-dev-20261109.147 --repo Pair-AI-Platform/node