[GareArc]

Summary

• Node.js v20.20.0 → v24.22.1. Node published a security release on Oct 21, 2026 with 10 CVEs. The worst is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that can be reached through fetch() when a server replies with Content-Encoding: br. The sandbox runs user JavaScript that can fetch any URL, so it is exposed. Node 20 is end-of-life and gets no fix, so this has to change major version. 24 is the same LTS line, with the same 24.22.1 fix, that the dify images and the agent runtime use.
• Go 1.26.8 → 1.26.10. 1.26.10 fixes CVE-2026-111943 in crypto/x509. 1.26.9 also had security fixes in net/http, crypto/tls and net/textproto.

Only docker/versions.yaml and the Go default in docker/templates/test.dockerfile change, as in #224, #223 and #287.

Risk

The Node runner loads seccomp through koffi, which uses Node-API, so it does not depend on the Node ABI. The real risk is a syscall that Node 24 uses and the seccomp allow list does not have. The test workflow builds the test image with these versions and runs the runner tests on amd64 and arm64, so it will catch that.

Testing

• ./generate.sh test amd64 and ./generate.sh production arm64 produce golang:1.26.10 and node-v24.22.1.
• The v24.22.1 tarballs exist on npmmirror for linux-x64 and linux-arm64.
• Not run locally. Relying on the CI test workflow above.

The matching ee-release change is in langgenius/ee-release.