The June 18 2026 Node.js security releases fix several HIGH/MEDIUM CVEs
on the 24.x line, with 24.17.0 as the first patched release. The service
images were pinned to 24.15, below that line. Bump to 24.18-alpine3.23
(latest 24.x) to pick up the fixes, including:
- CVE-2026-48618 (HIGH) TLS wildcard-depth auth bypass
- CVE-2026-48933 (HIGH) WebCrypto AES integer overflow crash
- CVE-2026-48928/48930/48934 (MEDIUM) TLS/SNI identity verification bypasses
- CVE-2026-48619 (MEDIUM) unbounded HTTP/2 memory growth via ORIGIN frames
Advisory: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: handle built css assets
* chore: let prettier handle css code
* refactor: let webpack build css assets
* chore: prettier on bskyembed
* chore: touch empty.txt on css directory
* chore: do the same to the workflow
* skeleton of embedr service, based on bskyweb
* embedr container setup
* builds on this branch
* actual routes
* fix embedr go:embed
* tweak embedr dockerfile
* progress on embedr
* fix path params
* tweaks to build process
* try to get embedr dockerfile to install embed deps
* build this branch
* updates to match sam's output HTML
* try to unbreak embedr dockerfile
* small embedr tweak
* docker hack
* get embed.js copied over to embedr
* don't x-frame-options for embed.bsky.app
* bskyembed: remove a console.log
* use html/template for golang snippet generation
* simplify embedr API fetches
* missing file
* Rm console.log fully
---------
Co-authored-by: Dan Abramov <dan.abramov@gmail.com>
Austin McKinley