From d9dabedad2a13db3d049e83574ced776bd90398b Mon Sep 17 00:00:00 2001
From: J-Dog <j-dog@j-dog.net>
Date: Wed, 21 Oct 2026 16:37:23 -0700
Subject: [PATCH 1/2] Update the Node base image to 22.23.4

Moves the runtime from node:25.9.0 to node:22.23.4-bookworm and the dependency stage to node:22.23.4-alpine, both digest-pinned, for the CVE-2026-111497 Brotli decoder fix (Node 25 gets no fix). The full bookworm image keeps wget for the compose healthcheck. No code changes.
---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 5df2b44..f1d95ee 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,10 @@
-FROM node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402 AS dependencies
+FROM node:22.23.4-alpine@sha256:ce8d97f7cfc7c5386421eb932df20a29df99b1a7f469f6157d5c9956702ffadc AS dependencies
 WORKDIR /XChainDecoder
 COPY ./package.json /XChainDecoder/package.json
 COPY ./package-lock.json /XChainDecoder/package-lock.json
 RUN npm ci --omit=dev
 
-FROM node:25.9.0@sha256:78839ac448c23517f8eab2e8f7943d9b4f73979eb7f8bed2c73dbf72ff869e7b AS decoder
+FROM node:22.23.4-bookworm@sha256:2bd396628eceb5c999a6e43731fab69d5fb98b94ba9d9d90b5f64575c5178765 AS decoder
 WORKDIR /XChainDecoder
 COPY ./package.json /XChainDecoder/package.json
 COPY ./package-lock.json /XChainDecoder/package-lock.json

From a4612bc23673421574478281c07ab67b7c5bb41e Mon Sep 17 00:00:00 2001
From: J-Dog <j-dog@j-dog.net>
Date: Wed, 21 Oct 2026 16:37:37 -0700
Subject: [PATCH 2/2] chore(release): v0.23.3

---
 CHANGELOG.md      | 5 +++++
 package-lock.json | 4 ++--
 package.json      | 2 +-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f83cd92..ab968ec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.23.3] - 2026-10-21
+
+### Security
+- Moved the runtime image from Node 25.9.0 to Node 22.23.4 for the CVE-2026-111497 Brotli decoder fix.
+
 ## [0.23.0] - 2026-10-11
 
 ### Added
diff --git a/package-lock.json b/package-lock.json
index b20b5e0..7c5d9c0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "xchain-decoder",
-  "version": "0.23.0",
+  "version": "0.23.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "xchain-decoder",
-      "version": "0.23.0",
+      "version": "0.23.3",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "axios": "^1.18.1",
diff --git a/package.json b/package.json
index 7a68c9a..5619b82 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "xchain-decoder",
   "description": "xchain-decoder decodes XChain platform transactions from a given blockchain and populates a database with the decoded data.",
-  "version": "0.23.0",
+  "version": "0.23.3",
   "license": "AGPL-3.0-or-later",
   "repository": {
     "type": "git",