Repository navigation
Conversation
gskril
marked this pull request as ready for review
October 24, 2026 02:03
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pins Bun to 1.4.4 and Node to 22.23.4 across package metadata, .nvmrc, CI and contributor instructions. Adds a scoped Playwright 1.62.1 override and regenerates bun.lock: the previously locked Playwright 1.57.0 selects Chromium 143 with the affected Brotli revision; 1.62.1 selects Chromium 151.0.7922.34 with the fixed cfa184a revision. Vocs stays at 1.4.1. The regenerated lock includes incidental same-version MetaMask deduplication, not an unrelated package upgrade.
Validation: frozen Bun 1.4.4 installation with lifecycle scripts disabled passed, content generation passed, and the full build reached Vocs bundle compilation before the executor terminated it with SIGKILL (exit 137). A complete production build is therefore not verified. JSON/YAML parsing and git diff --check passed. Browser execution was not verified: the official Playwright headless-shell download returned an invalid archive, and Chrome launch is blocked by this cloud executor's IPC restrictions.
Rollout: install the matching patched Chromium artifact, rebuild with the patched runtimes and verify actual hosting/build settings. CI and manifest pins do not attest to Cloudflare-managed production runtimes. Firefox and WebKit were not assessed. This remains a draft with the build limitation disclosed.
Sources:
This is a scoped CVE-2026-111497 fix, not a claim that the repository, dependencies or hosted service has no other security issues.