fix(security): ignore Node bundled CVEs flagged by Trivy 0.72

Trivy 0.72 reports sigstore and undici findings in the Node.js dist
as failing despite fixes existing upstream; bump Node to 24.18.0 and
track the CVEs in trivyignore until the base bundle refreshes.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: miragecentury

.trivyignore

@@ -19,6 +19,9 @@ CVE-2026-23745 exp:2026-08-19
 CVE-2026-23950 exp:2026-08-19
 CVE-2026-24842 exp:2026-08-19
 CVE-2026-26960 exp:2026-08-19
+# Node.js bundled deps (sigstore, undici in official node dist)
+CVE-2026-48815 exp:2026-08-19
+CVE-2026-12151 exp:2026-08-19
 #
 # .NET (Runner.Plugins / Runner.Sdk deps)
 CVE-2024-38095 exp:2026-08-19

CHANGELOG.md

@@ -64,12 +64,14 @@
 - **image:** pre-cache commonly used GitHub Actions from `manifest.yaml` into the runner `_work/_actions` directory during image build
 - **image:** bump syft, grype, yq, argo, kargo, pack, and kubectl to latest releases
 - **image:** install OpenAPI npm CLIs in a single prefix with transitive dependency CVE overrides
+- **image:** bump Node.js to 24.18.0
 
 ### Fixed
 
 ### Security
 
 - **image:** extend `.trivyignore` for unfixed Go CVEs in base containerd and pinned CLIs
+- **image:** ignore Node.js bundled sigstore and undici CVEs until upstream node dist updates
 
 ## [1.2.3](https://github.com/DeerHide/python-github-runner/compare/v1.2.2...v1.2.3) (2026-04-25)
 

Containerfile

@@ -117,7 +117,7 @@ RUN curl -sSL -o /tmp/pack.tgz \
     && rm /tmp/pack.tgz
 
 # Install Node.js (bundles npm and npx)
-ARG NODE_VERSION=24.16.0
+ARG NODE_VERSION=24.18.0
 RUN curl -sSL -o /tmp/node.tgz \
       "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.gz" \
     && tar -xzf /tmp/node.tgz -C /usr/local --strip-components=1 \

manifest.yaml

@@ -15,7 +15,7 @@ build:
     - GRYPE_VERSION=0.115.0
     - HADOLINT_VERSION=2.14.0
     - YQ_VERSION=4.53.3
-    - NODE_VERSION=24.16.0
+    - NODE_VERSION=24.18.0
     - BUN_VERSION=1.3.14
     - REDOCLY_CLI_VERSION=2.39.0
     - SPECTRAL_CLI_VERSION=6.16.1