October 21 was a busy day for anyone who runs servers. PHP fixed two critical remote code execution bugs. GitLab fixed one rated 10.0. Node.js shipped security releases for its 22, 24 and 26 lines, including an out-of-bounds write in the Brotli decoder that the advisory says can lead to remote code execution.

Different stacks, same job: patch it, then prove the patch is running.

The Node one looked like a one-line change:

- FROM node:22.12.0-alpine + FROM node:22.23.4-alpine

Enter fullscreen mode

Exit fullscreen mode

Bump the number, rebuild, deploy. I did this on a set of containerized services that week, and the version bump was the easiest part. The real work was finding every place the version lived, noticing what else the new image changed, and checking which pods actually picked it up.

Diagram of the whole trip (① pick the patch, ② change every pin, ③ the image moves its OS packages too, ④ only rebuilt services get the fix, ⑤ deployed isn't running, so check the pods): see it on maruf.ing

1.…