From 98505d4158703055c2ddb087c09c37134e5d74c8 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 10:31:07 +0000
Subject: [PATCH 1/2] Initial plan


From c8c8d7bc718d360fe664161bc97f8cbc30797474 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 10:44:38 +0000
Subject: [PATCH 2/2] fix: bump npm to 11.19.0 and patch bundled
 tar/brace-expansion in gh-aw-node image

Resolves container image vulnerabilities found in ghcr.io/github/gh-aw-node:
- Bump NPM_VERSION from 11.18.0 to 11.19.0
- Add explicit patch of npm bundled tar to >=7.5.22 and brace-expansion to >=5.0.8
- Alpine CVEs (CVE-2026-58055, CVE-2025-60876) addressed by apk upgrade on rebuild

Closes #49295

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .changeset/patch-refresh-gh-aw-node.md       | 2 +-
 actions/setup/js/Dockerfile.safe-outputs-mcp | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.changeset/patch-refresh-gh-aw-node.md b/.changeset/patch-refresh-gh-aw-node.md
index bab86bbfc78..22c07828436 100644
--- a/.changeset/patch-refresh-gh-aw-node.md
+++ b/.changeset/patch-refresh-gh-aw-node.md
@@ -2,4 +2,4 @@
 "gh-aw": patch
 ---
 
-Refresh the `gh-aw-node` image's Alpine and npm packages and publish it for both amd64 and arm64.
+Refresh the `gh-aw-node` image's Alpine and npm packages and publish it for both amd64 and arm64. Bump npm to 11.19.0 and patch bundled `tar` to ≥7.5.22 and `brace-expansion` to ≥5.0.8 to address container security findings (CVE-2026-58055, CVE-2025-60876, and related npm dependency vulnerabilities).
diff --git a/actions/setup/js/Dockerfile.safe-outputs-mcp b/actions/setup/js/Dockerfile.safe-outputs-mcp
index 81c48834a8e..5b349cb1bca 100644
--- a/actions/setup/js/Dockerfile.safe-outputs-mcp
+++ b/actions/setup/js/Dockerfile.safe-outputs-mcp
@@ -7,13 +7,16 @@ ARG NODE_IMAGE
 ARG NODE_IMAGE_DIGEST=""
 ARG NODE_IMAGE_UPDATED_AT=""
 ARG DOCKERFILE_HASH=""
-ARG NPM_VERSION=11.18.0
+ARG NPM_VERSION=11.19.0
 
 # Intentional: upgrade all packages to pick up security fixes; downstream digest pins the result.
+# After upgrading npm, patch its bundled dependencies to meet minimum safe versions
+# (tar >= 7.5.21 for CVE-2025-tar, brace-expansion >= 5.0.8 for CVE-2025-brace-expansion).
 RUN apk upgrade --no-cache \
     && apk add --no-cache git \
     && apk info -v | sort \
     && npm install --global "npm@${NPM_VERSION}" \
+    && npm install --prefix "$(npm root -g)/npm" --no-save "tar@^7.5.22" "brace-expansion@^5.0.8" \
     && npm cache clean --force
 
 LABEL org.opencontainers.image.source="https://github.com/github/gh-aw" \