[masih]

ECR's scan of the current runner overlay (runner-overlay-bd5e54c…, built on omnigent-host:v0.17.0) still flags CVE-2026-111497 as critical. #498 fixed the copy of Brotli inside Node, but the base also ships Debian's system libbrotli1 at 1.1.0-2+b7, which curl and libcurl link, and that's the package the scanner reports.

This upgrades only libbrotli1 to trixie's 1.1.0-2+deb13u1 (DSA-6582-1) and fails the build if the installed version is older, keeping the v0.17.0 base unchanged. Once ecr-runner.yml publishes the new tag, the runner digest in platform's sandbox-config-patch.yaml and sandbox-image-prepull.yaml needs bumping to reach the dev cluster.

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access that start with 'Devin'.

• Disable automatic comment, CI, and merge conflict monitoring

[cursor]

PR Summary

Low Risk
Build-time package pin with a version gate; no application logic changes, only runner image supply-chain hardening.

Overview
Addresses the remaining Brotli RCE (CVE-2026-111497) finding on the runner image after the Node 22.23.4 overlay: ECR was still flagging Debian’s system libbrotli1 (1.1.0-2+b7), which curl/libcurl use.

The overlay now runs apt-get with --only-upgrade libbrotli1 to at least 1.1.0-2+deb13u1 (DSA-6582-1) and fails the image build if the installed package is older. Comments note this step becomes a no-op once the base image ships the fixed library, similar to the Node override guard.

^{Reviewed by Cursor Bugbot for commit 5c4793f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[seidroid]

Upgrades Debian's system libbrotli1 in the runner overlay to the DSA-6582-1 fixed version, and the build fails if the installed version is still older. It was reviewed against the PR merge tree (96159ca). Nothing blocks: the apt step cleans up its lists and its version assertion fails the build visibly, and codex's reading of no findings agrees with mine, so it added nothing to keep or drop.

1 nit, not posted on the code

• Dockerfile.runner:36 — The Node override above fails the build once the base ships the fix, so it gets dropped. This step instead stays as a silent no-op, so it will outlive its purpose unless someone remembers to remove it when the base moves past 1.1.0-2+b7.

_{seidroid review · decision approve · session 1342e80bc80840f58470b231a8c884ae · turn resp_claude_1dbbcfdd6a2bbabb25a95a73b02cc2d2 · item eb0ec9e4eac15b20b81a62d6ee47c713}

Findings: 0 blocking | 0 non-blocking | 0 posted inline