Skip to content

fix: update Node.js and Bun for CVE-2026-111497 and enable Renovate - #33

Merged
exKAZUu merged 2 commits into
mainfrom
fix/brotli-cve-2026-111497
Oct 24, 2026
Merged

exKAZUu merged 2 commits into
mainfrom
fix/brotli-cve-2026-111497

Conversation

@exKAZUu

@exKAZUu exKAZUu commented Oct 24, 2026 •

Copy link
Copy Markdown
Member

Requirements

  • required: Pin Node.js and Bun to releases patched for CVE-2026-111497 (out-of-bounds write in the bundled Brotli decoder)
  • required: Add the same Renovate config as the other WillBooster repositories so Renovate is enabled
  • required: CI passes on the updated runtimes

Changes

  • mise.toml: node 24.21.0 → 24.22.1, bun 1.4.2 → 1.4.4
  • renovate.jsonc: extend github>WillBooster/willbooster-configs:renovate.jsonc
  • example_course_imported_html_css/judge.ts: await the element handle before calling evaluate instead of .then((handle) => handle.evaluate(...))

Why the judge changes

Under Bun 1.4.4 the HTML/CSS judge failed with undefined is not an object (evaluating 'site.toString'). puppeteer-core's withSourcePuppeteerURLIfNone reads the third frame of a structured stack trace (stack[2]) unconditionally. The .then arrow is a tail call that JavaScriptCore eliminates, so the stack held only puppeteer's own frames; Bun 1.4.2 happened to append a native processTicksAndRejections frame there, which Bun 1.4.4 no longer does on this path. Awaiting the handle first keeps the judge's own frame on the stack.

Verification

bun run test passes locally on both Bun 1.4.4 and 1.4.2, and CI passes.

exKAZUu and others added 2 commits October 25, 2026 08:26
Co-authored-by: WillBooster (Claude Code) <agent@willbooster.com>
`.then((handle) => handle.evaluate(...))` is a tail call that JavaScriptCore
eliminates, so under Bun 1.4.4 puppeteer's `withSourcePuppeteerURLIfNone`
finds no third stack frame and throws `undefined is not an object
(evaluating 'site.toString')`. Awaiting the handle first keeps the judge's
own frame on the stack.

Co-authored-by: WillBooster (Claude Code) <agent@willbooster.com>
@exKAZUu exKAZUu self-assigned this Oct 24, 2026
@exKAZUu
exKAZUu merged commit e9d5dfc into main Oct 24, 2026
3 checks passed
@exKAZUu
exKAZUu deleted the fix/brotli-cve-2026-111497 branch October 24, 2026 23:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant