From bf71c329c65ba1f4d99c5f53ea8c02984ba02755 Mon Sep 17 00:00:00 2001
From: Austin McKinley <austin@blueskyweb.xyz>
Date: Sun, 5 Jul 2026 21:20:04 -0700
Subject: [PATCH] build: bump Node to 24.18 for June 2026 security releases

The June 18 2026 Node.js security releases fix several HIGH/MEDIUM CVEs
on the 24.x line, with 24.17.0 as the first patched release. The service
images were pinned to 24.15, below that line. Bump to 24.18-alpine3.23
(latest 24.x) to pick up the fixes, including:

- CVE-2026-48618 (HIGH) TLS wildcard-depth auth bypass
- CVE-2026-48933 (HIGH) WebCrypto AES integer overflow crash
- CVE-2026-48928/48930/48934 (MEDIUM) TLS/SNI identity verification bypasses
- CVE-2026-48619 (MEDIUM) unbounded HTTP/2 memory growth via ORIGIN frames

Advisory: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .nvmrc                | 2 +-
 Dockerfile.bskylink   | 4 ++--
 Dockerfile.bskyogcard | 4 ++--
 Dockerfile.embedr     | 2 +-
 eas.json              | 2 +-
 package.json          | 4 ++--
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.nvmrc b/.nvmrc
index 5bf4400f22..ca5c350055 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-24.15.0
+24.18.0
diff --git a/Dockerfile.bskylink b/Dockerfile.bskylink
index 934b40d1ad..719e827a9f 100644
--- a/Dockerfile.bskylink
+++ b/Dockerfile.bskylink
@@ -1,4 +1,4 @@
-FROM node:24.15.0-alpine3.22 AS build
+FROM node:24.18.0-alpine3.23 AS build
 
 # Move files into the image and install
 WORKDIR /app
@@ -14,7 +14,7 @@ RUN yarn build
 RUN yarn install --production --ignore-scripts --prefer-offline
 
 # Uses assets from build stage to reduce build size
-FROM node:24.15.0-alpine3.22
+FROM node:24.18.0-alpine3.23
 
 RUN apk add --update dumb-init
 
diff --git a/Dockerfile.bskyogcard b/Dockerfile.bskyogcard
index dc9747f949..f5f27a2f58 100644
--- a/Dockerfile.bskyogcard
+++ b/Dockerfile.bskyogcard
@@ -1,4 +1,4 @@
-FROM node:24.15.0-alpine3.22 AS build
+FROM node:24.18.0-alpine3.23 AS build
 
 # Tells pnpm to run non-interactively (needed for install/script steps)
 ENV CI=true
@@ -19,7 +19,7 @@ RUN pnpm install-fonts && pnpm build
 RUN pnpm install --prod --ignore-scripts --prefer-offline
 
 # Uses assets from build stage to reduce build size
-FROM node:24.15.0-alpine3.22
+FROM node:24.18.0-alpine3.23
 
 RUN apk add --update dumb-init
 
diff --git a/Dockerfile.embedr b/Dockerfile.embedr
index 203149115f..3bdbaabc92 100644
--- a/Dockerfile.embedr
+++ b/Dockerfile.embedr
@@ -5,7 +5,7 @@ WORKDIR /usr/src/social-app
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Node
-ENV NODE_VERSION=24.15.0
+ENV NODE_VERSION=24.18.0
 ENV NVM_DIR=/usr/share/nvm
 
 # Go
diff --git a/eas.json b/eas.json
index 83549039cd..7ab73ab4c8 100644
--- a/eas.json
+++ b/eas.json
@@ -6,7 +6,7 @@
   },
   "build": {
     "base": {
-      "node": "24.15.0"
+      "node": "24.18.0"
     },
     "development": {
       "extends": "base",
diff --git a/package.json b/package.json
index 6eed0047ea..01f0983709 100644
--- a/package.json
+++ b/package.json
@@ -3,7 +3,7 @@
   "version": "1.127.0",
   "private": true,
   "engines": {
-    "node": ">=24.15.0"
+    "node": ">=24.18.0"
   },
   "devEngines": {
     "packageManager": {
@@ -13,7 +13,7 @@
     },
     "runtime": {
       "name": "node",
-      "version": "^24.15.0",
+      "version": "^24.18.0",
       "onFail": "download"
     }
   },