1 release 23 tags

RSS feed

• 2.7.2 338243bd9d

  Compare

  2.7.2 Stable

  Michelle released this 2026-10-22 23:49:09 +02:00 | 1 commits to main since this release

  2.7.2

  Security and maintenance release. The Docker image now ships Node.js 22.23.4, which contains the fixes from the Node.js security release of October 21, 2026. All npm dependencies are updated as well, including six major versions. There are no configuration changes.

  ⚠️ Before upgrading

  • Pull the new image and recreate the container (docker compose pull && docker compose up -d). Running containers keep the vulnerable Node.js version until they are replaced.
  • Running without Docker? Update Node.js yourself to 22.23.4 (or 24.22.1 / 26.12.1). Redlight now needs Node.js 22 or newer, because better-sqlite3 13 and concurrently 10 dropped Node.js 20, which is end-of-life.

  🔒 Security fixes

  Updating is strongly recommended.

  • Node.js 22.23.4 in the Docker image. The fixes that matter most for Redlight:
    • CVE-2026-111497 (High): an out-of-bounds write in the Brotli decoder can allow remote code execution. Redlight's API accepts Brotli-compressed request bodies, so this can be reached without signing in.
    • CVE-2026-106069 (High) and CVE-2026-106072 (Medium): TLS certificate hostname checks could be bypassed with non-canonical IP addresses. This affects outgoing HTTPS connections, e.g. to BigBlueButton, federation peers, the OIDC provider and SMTP.
    • More fixes for DNS, HTTP keep-alive and the permission model. See the Node.js advisory.
  • ip-address (GHSA-rxp7-6hxx-x8q5, moderate): a long IPv6 zone identifier could stall the process. Fixed through the express-rate-limit update. npm audit reports 0 vulnerabilities.

  ⬆️ Dependencies

  Major upgrades, tested with the full test suite, against DragonflyDB and in the Docker image:

  • better-sqlite3 12 → 13: ships prebuilt binaries (no compile step on install) and bundles SQLite 3.53.4
  • ioredis 5 → 6: uses RESP3 when the server supports it and falls back to RESP2 otherwise. No configuration changes needed.
  • rate-limit-redis 5 → 6
  • pdfkit 0.18 → 0.20 (PDF export of learning analytics)
  • dotenv 17 → 18: .env files are parsed exactly as before. The "injecting env" line at startup is gone.
  • concurrently 9 → 10 (development only)

  Plus the latest minor and patch versions, e.g. express 5.3.0, express-rate-limit 8.7.1, multer 2.5.0, nodemailer 10.2.1, react 19.3.1, react-router-dom 7.18.4 and vite 8.3.5.

  What's Changed

  • chore(deps): update all dependencies incl. major upgrades (79adff4)
  • chore: bump version to 2.7.2 in package.json, package-lock.json and federation.js (338243b)

  Full Changelog: https://forgejo.scrunkly.cat/Michelle/redlight/compare/2.7.1...2.7.2

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads