github-featured/triggerdotdev--trigger.dev
2
0
Fork 0
Code Issues Pull Requests Deployments Models Agent Notes Packages Projects Releases Wiki Activity

fix: upgrade Node.js to 20.20.0 to address async_hooks DoS vulnerability (#2890)

Browse Source 
## Summary

- Upgrades Node.js from 20.19.0 to 20.20.0 (and 22.12.0 to 22.22.0 for
supervisor) to address the async_hooks stack overflow DoS vulnerability
- Adds `maxDepth` parameter (default 128) to `flattenAttributes` and
`unflattenAttributes` to prevent stack overflow on maliciously deep
nested structures

## Details

The vulnerability (patched in Node.js 20.20.0, 22.22.0, 24.13.0, 25.3.0)
causes unrecoverable crashes (exit code 7) when stack overflow occurs
during async_hooks callbacks. Since the webapp uses `AsyncLocalStorage`,
it was theoretically vulnerable.

### Changes

**Node.js version updates:**
- `docker/Dockerfile`: 20.11.1 → 20.20.0
- `apps/supervisor/Containerfile`: 22-alpine → 22.22.0-alpine
- `.nvmrc`: 20.19.0 → 20.20.0
- `apps/supervisor/.nvmrc`: 22.12.0 → 22.22.0
- `references/prisma-7/.nvmrc`: 20.19.0 → 20.20.0
- All GitHub workflows: 20.19.0 → 20.20.0

**Defense in depth:**
- Added `maxDepth` parameter to `flattenAttributes()` and
`unflattenAttributes()` in `packages/core` to prevent stack overflow on
deeply nested user input

## Test plan

- [x] All existing `flattenAttributes` tests pass (50 tests)
- [x] New tests for depth limiting added
- [x] Verify Docker builds work with new base images
This commit is contained in:
Eric Allam
2026-01-15 10:47:44 +00:00
committed by GitHub
parent b1e21cf03b
commit 936bddf198
18 changed files with 142 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/changesets-pr.yml
+2 -2
View File
@@ -34,7 +34,7 @@ jobs:
- name: Setup node
uses: buildjet/setup-node@v4
with:
node-version: 20.19.0
node-version: 20.20.0
cache: "pnpm"
- name: Install dependencies
@@ -83,7 +83,7 @@ jobs:
- name: Setup node
uses: buildjet/setup-node@v4
with:
node-version: 20.19.0
node-version: 20.20.0
- name: Install and update lockfile
run: pnpm install --no-frozen-lockfile
.github/workflows/claude.yml
+1 -1
View File
@@ -38,7 +38,7 @@ jobs:
- name: ⎔ Setup node
uses: buildjet/setup-node@v4
with:
node-version: 20.19.0
node-version: 20.20.0
cache: "pnpm"
- name: 📥 Download deps
.github/workflows/e2e.yml
+1 -1
View File
@@ -36,7 +36,7 @@ jobs:
- name: ⎔ Setup node
uses: buildjet/setup-node@v4
with:
node-version: 20.19.0
node-version: 20.20.0
- name: 📥 Download deps
run: pnpm install --frozen-lockfile --filter trigger.dev...
.github/workflows/release.yml
+2 -2
View File
@@ -86,7 +86,7 @@ jobs:
- name: Setup node
uses: buildjet/setup-node@v4
with:
node-version: 20.19.0
node-version: 20.20.0
cache: "pnpm"
# npm v11.5.1 or newer is required for OIDC support
@@ -154,7 +154,7 @@ jobs:
- name: Setup node
uses: buildjet/setup-node@v4
with:
node-version: 20.19.0
node-version: 20.20.0
cache: "pnpm"
# npm v11.5.1 or newer is required for OIDC support
.github/workflows/typecheck.yml
+1 -1
View File
@@ -24,7 +24,7 @@ jobs:
- name: ⎔ Setup node
uses: buildjet/setup-node@v4
with:
node-version: 20.19.0
node-version: 20.20.0
cache: "pnpm"
- name: 📥 Download deps
.github/workflows/unit-tests-internal.yml
+2 -2
View File
@@ -58,7 +58,7 @@ jobs:
- name: ⎔ Setup node
uses: buildjet/setup-node@v4
with:
node-version: 20.19.0
node-version: 20.20.0
cache: "pnpm"
# ..to avoid rate limits when pulling images
@@ -127,7 +127,7 @@ jobs:
- name: ⎔ Setup node
uses: buildjet/setup-node@v4
with:
node-version: 20.19.0
node-version: 20.20.0
# no cache enabled, we're not installing deps
- name: Download blob reports from GitHub Actions Artifacts
.github/workflows/unit-tests-packages.yml
+2 -2
View File
@@ -58,7 +58,7 @@ jobs:
- name: ⎔ Setup node
uses: buildjet/setup-node@v4
with:
node-version: 20.19.0
node-version: 20.20.0
cache: "pnpm"
# ..to avoid rate limits when pulling images
@@ -127,7 +127,7 @@ jobs:
- name: ⎔ Setup node
uses: buildjet/setup-node@v4
with:
node-version: 20.19.0
node-version: 20.20.0
# no cache enabled, we're not installing deps
- name: Download blob reports from GitHub Actions Artifacts
.github/workflows/unit-tests-webapp.yml
+2 -2
View File
@@ -58,7 +58,7 @@ jobs:
- name: ⎔ Setup node
uses: buildjet/setup-node@v4
with:
node-version: 20.19.0
node-version: 20.20.0
cache: "pnpm"
# ..to avoid rate limits when pulling images
@@ -135,7 +135,7 @@ jobs:
- name: ⎔ Setup node
uses: buildjet/setup-node@v4
with:
node-version: 20.19.0
node-version: 20.20.0
# no cache enabled, we're not installing deps
- name: Download blob reports from GitHub Actions Artifacts