bring in V22.21.1 patches into v22.23.4 by nneha-a · Pull Request #27 · Asana/node

nneha-a · 2026-10-23T21:28:00Z

No description provided.

…t run OSX

Ubuntu 22.04 ARM64 mirrors (ports.ubuntu.com) are rate-limiting with 403 errors. Ubuntu 20.04 works reliably for both x64 and ARM64 builds. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

Ubuntu 22.04 is required for production and matches the v20 FIPS build. The earlier 403 errors were transient rate-limiting, not a fundamental issue. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

Adds retry loop with 5 attempts and 15-second delays to handle transient mirror rate-limiting (403 errors) on ARM64 builds. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

Combines apt-get update, software-properties-common install, PPA setup, and main package install into one retry loop. This protects all network operations from transient 403 errors on ARM64 mirrors. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

Same retry pattern as FIPS Dockerfile - consolidates all apt-get commands into single retry loop to handle transient mirror failures. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

- Build Node -> Build Node (Standard) - Build Node with FIPS-enabled OpenSSL -> Build Node (FIPS) - Build node-fibers with prebuilt Node -> Build Custom Fibers - Build node-packages with prebuilt Node -> Build Node-Packages Also updated workflow_run triggers to reference new name. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

…dates - Use versioned fibers base package (20250515) which includes Node 20 binaries - Add validation that combined fibers archive contains Node 18, 20, and 22 binaries - Add diagnostic output when linux-*.gz injection step finds no files - Replace broken sed block-removal commands with Python to avoid leaving empty stubs - Preserve nodejsfips (Node 20 FIPS) toolchain instead of removing it Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

node_modules/.bin/node-gyp was not found because node-gyp was not explicitly installed in the pprof-source workdir. Add an explicit npm install step to make it available. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Replace --ignore-scripts with --build-from-source so npm properly runs build steps for pprof dependencies - Switch node-gyp rebuild to use explicit --nodedir flag (more reliable than npm_config_nodedir env var) - Use find to locate the built .node binary instead of hardcoding profiler.node, which may differ across pprof-nodejs versions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Original commit message: Detect and report invalid stream earlier. PiperOrigin-RevId: 876198329 PR-URL: https://github.com/nodejs-private/node-private/pull/1002 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> CVE-ID: CVE-2026-111497 (cherry picked from commit 67d2947)

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: https://github.com/nodejs-private/node-private/pull/1002 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> CVE-ID: CVE-2026-111497 (cherry picked from commit a18ec92)

Backport fix for CVE-2026-111497 (brotli block switch)

semgrep-code-asana · 2026-10-23T21:31:39Z

+
+      # Flatten directory structure if needed (handle both usr/local and direct layouts)
+      if [ -d "$target_dir/usr/local" ]; then
+        mv $target_dir/usr/local/* "$target_dir"


🔵 Low severity issue identified in your code:

Unquoted $target_dir can be split or glob-expanded, causing mv to use unintended source paths. This makes archive flattening unreliable and potentially moves or overwrites the wrong files.

More details about this

$target_dir is unquoted in the source path of mv $target_dir/usr/local/* "$target_dir". If target_dir contains whitespace or shell metacharacters, Bash performs word splitting and pathname expansion before mv runs, which can turn the intended directory path into multiple or unintended source paths. This can move the wrong files, fail to flatten the extracted archive, or overwrite an unexpected destination. Quoting this expansion preserves the directory name as one path while leaving the deliberate * selection of its contents intact.

To resolve this comment:

✨ Commit fix suggestion

Quote the variable portion of the source path while leaving the glob unquoted so the shell expands matching files individually:
mv "$target_dir"/usr/local/* "$target_dir"

Keep the destination quoted as "$target_dir" so directory names containing whitespace remain a single argument.

Do not write mv "$target_dir/usr/local/*" "$target_dir" because that prevents * from expanding to the files inside the directory.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by unquoted-variable-expansion-in-command.

Please reach out to Security (go/sec-inbox) if you need help with this.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-asana · 2026-10-23T21:31:40Z

+gh release download -R Asana/node node-v22.21.1-release -p "packages_*.gz"
+echo "Moving packages to $CODEZ/node/gyp"
+mv packages_arm64.tar.gz $CODEZ/node/gyp/packages_arm64_node22.tar.gz
+mv packages_x64.tar.gz $CODEZ/node/gyp/packages_amd64_node22.tar.gz


🔵 Low severity issue identified in your code:

The unquoted $CODEZ expansion can be split or pathname-expanded, causing mv to use the wrong destination or fail when placing the amd64 package.

More details about this

On line mv packages_x64.tar.gz $CODEZ/node/gyp/packages_amd64_node22.tar.gz, the $CODEZ expansion is unquoted. If CODEZ contains whitespace or characters matched by pathname expansion, Bash can split or expand the destination into multiple arguments, so mv may fail or move the archive to an unintended path. This is especially relevant here because CODEZ supplies the shared destination root for downloaded release artifacts; an unexpected value can prevent the amd64 package from being placed at node/gyp/packages_amd64_node22.tar.gz.

To resolve this comment:

✨ Commit fix suggestion

Quote the destination path so the value of CODEZ cannot be split on whitespace or shell separators:
mv packages_x64.tar.gz "$CODEZ/node/gyp/packages_amd64_node22.tar.gz"

Keep the source path quoted as well for consistent safe shell handling:
mv "packages_x64.tar.gz" "$CODEZ/node/gyp/packages_amd64_node22.tar.gz"

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by unquoted-variable-expansion-in-command.

Please reach out to Security (go/sec-inbox) if you need help with this.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-asana · 2026-10-23T21:31:41Z

+# Download packages and move to codez
+gh release download -R Asana/node node-v22.21.1-release -p "packages_*.gz"
+echo "Moving packages to $CODEZ/node/gyp"
+mv packages_arm64.tar.gz $CODEZ/node/gyp/packages_arm64_node22.tar.gz


🔵 Low severity issue identified in your code:

Unquoted $CODEZ can be split or glob-expanded, so mv may use an incorrect destination path or fail.

More details about this

$CODEZ is unquoted in the destination argument to mv on this line. If CODEZ contains whitespace or shell glob characters, Bash can split or expand it, causing the archive to be moved to the wrong location or making mv fail; quoting preserves $CODEZ/node/gyp/packages_arm64_node22.tar.gz as one destination path.

To resolve this comment:

✨ Commit fix suggestion

Double-quote the $CODEZ expansion in both mv commands so the destination path remains one argument even when it contains whitespace or shell metacharacters:
mv packages_arm64.tar.gz "$CODEZ/node/gyp/packages_arm64_node22.tar.gz"
mv packages_x64.tar.gz "$CODEZ/node/gyp/packages_amd64_node22.tar.gz"

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by unquoted-variable-expansion-in-command.

Please reach out to Security (go/sec-inbox) if you need help with this.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-asana · 2026-10-23T21:31:42Z

+
+# Build Node.js
+echo "Building Node.js (this may take a while)..."
+make -j${JOBS}


🔵 Low severity issue identified in your code:

Unquoted JOBS can be split or glob-expanded before make runs. This may change the parallel-job argument or pass unintended arguments to the build.

More details about this

make -j${JOBS} expands JOBS without quotes. Because JOBS can come from the environment (JOBS=${JOBS:-...}), whitespace, glob characters, or an altered IFS can split or transform its value into multiple command-line arguments, changing the requested parallelism or causing make to receive unintended targets and options. This makes the build behavior depend on untrusted or unexpected shell input rather than treating JOBS as one value.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

make -j${JOBS}

case "${JOBS}" in ''|*[!0-9]*|0*) printf '%s\n' "Error: JOBS must be a positive integer." >&2; exit 1;; esac; make -j"${JOBS}"

View step-by-step instructions

Quote the JOBS expansion in the make command: change make -j${JOBS} to make -j"${JOBS}".

Keep JOBS as a single scalar value; if parallel-job input can be user-controlled, validate it as a positive integer before invoking make. Quoting prevents shell word splitting and ensures make receives one job-count argument.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by unquoted-variable-expansion-in-command.

Please reach out to Security (go/sec-inbox) if you need help with this.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-asana · 2026-10-23T21:31:43Z

+fi
+echo "Validation passed: archive contains binaries for Node 18, 20, and 22"
+
+SHORT_HASH=$(cat temp.tgz | sha1sum | cut -c1-4)


🟡 Medium severity issue identified in your code:

The cat process is redundant in the temp.tgz hash pipeline. It adds needless process overhead and hides the direct input to sha1sum.

More details about this

SHORT_HASH=$(cat temp.tgz | sha1sum | cut -c1-4) uses cat only to feed temp.tgz into sha1sum; no transformation is performed before hashing. This unnecessary pipeline adds a process and obscures that sha1sum is reading the archive directly, making the hash calculation less clear and maintainable.

To resolve this comment:

✨ Commit fix suggestion

Replace the useless cat pipeline with input redirection:
SHORT_HASH=$(sha1sum < temp.tgz | cut -c1-4)

Keep the cut command so SHORT_HASH contains only the first four characters of the checksum.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by useless-cat.

Please reach out to Security (go/sec-inbox) if you need help with this.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-asana · 2026-10-23T21:31:44Z

+        run: |
+          docker build -t node22_fips_build -f ./${{ inputs.DOCKER_FILE }} .
+


🟠 High severity blocking issue identified in your code:
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.

Please reach out to Security (go/sec-inbox) if you need help with this.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-asana · 2026-10-23T21:31:46Z

Semgrep found 1 useless-cat finding:

stage_for_s3.bash
- L72 - Triage

🟡 Medium severity issue identified in your code:

Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file.

Please reach out to Security (go/sec-inbox) if you need help with this.

Semgrep found 12 github-actions-mutable-action-tag findings:

.github/workflows/build-node.yml
- L26 - Triage
- L73 - Triage
- L79 - Triage
- L85 - Triage
.github/workflows/build-node-packages.yml
- L31 - Triage
- L71 - Triage
.github/workflows/build-node-openssl-fips.yml
- L33 - Triage
- L80 - Triage
- L86 - Triage
- L92 - Triage
.github/workflows/build-node-fibers.yml
- L31 - Triage
- L68 - Triage

🟡 Medium severity issue identified in your code:

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Please reach out to Security (go/sec-inbox) if you need help with this.

JackStrohm-asana and others added 28 commits February 3, 2026 13:30

Initial patch

6f70fb0

s3 staging script

a8d4c9b

script to build locally instead of using docker containers which don'…

0c1288a

…t run OSX

update github actions to build node fibers

5e0424e

fix node-fibers branchname

2d64ee8

update staging directory

b9b6b32

Add fips build workflow

b577cda

change fiber and package build triggers

ba48e86

try to fix network errors on apt-get

9977ae6

working on apt-get failures

2118248

removed push trigger

5122fc2

another test

9260bf1

switch FIPS Dockerfile to Ubuntu 20.04

cf4884d

Ubuntu 22.04 ARM64 mirrors (ports.ubuntu.com) are rate-limiting with 403 errors. Ubuntu 20.04 works reliably for both x64 and ARM64 builds. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

revert FIPS Dockerfile to Ubuntu 22.04

3814757

Ubuntu 22.04 is required for production and matches the v20 FIPS build. The earlier 403 errors were transient rate-limiting, not a fundamental issue. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

add robust retry logic to FIPS Dockerfile apt-get

0824123

Adds retry loop with 5 attempts and 15-second delays to handle transient mirror rate-limiting (403 errors) on ARM64 builds. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

add robust retry logic to regular Node Dockerfile

18a6979

Same retry pattern as FIPS Dockerfile - consolidates all apt-get commands into single retry loop to handle transient mirror failures. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

added fips to the staging script to make sure we don't have cache issues

0f26935

make staging do fips and update asana codez codebase

829e1c9

update lockfile instructions

6dad6fe

Untested support for profiler

bd560ee

Install node-gyp before rebuilding pprof native binding

d2b5f7f

node_modules/.bin/node-gyp was not found because node-gyp was not explicitly installed in the pprof-source workdir. Add an explicit npm install step to make it available. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Merge pull request #25 from jrsells/cve-2026-111497

d3cff29

Backport fix for CVE-2026-111497 (brotli block switch)

semgrep-code-asana Bot reviewed Oct 23, 2026

View reviewed changes

nneha-a closed this Oct 23, 2026

Navigation Menu

Repository navigation

bring in V22.21.1 patches into v22.23.4 - #27

bring in V22.21.1 patches into v22.23.4#27
nneha-a wants to merge 28 commits into
v22.23.4from
v22.21.1

nneha-a commented Oct 23, 2026

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Uh oh!

semgrep-code-asana Bot commented Oct 23, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

	make -j${JOBS}
	case "${JOBS}" in ''\|[!0-9]\|0*) printf '%s\n' "Error: JOBS must be a positive integer." >&2; exit 1;; esac; make -j"${JOBS}"

		run: \|
		docker build -t node22_fips_build -f ./${{ inputs.DOCKER_FILE }} .

Conversation

nneha-a commented Oct 23, 2026

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

semgrep-code-asana Bot commented Oct 23, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

5 participants