English
Summary
- Update build, CI, and Docker Node.js to 24.22.1 for the October 21 security release.
- Upgrade vulnerable application and build dependencies, including Markdown rendering, sanitization, MCP, Vite, and the desktop runtime.
- Electron 44.9.3 still embeds Node.js 24.22.0. The desktop app therefore remains pending an upstream Electron release containing the October 21 Node.js fixes.
Highlights
- Rebuild container images with patched Node.js in both build and runtime stages.
- Resolve all npm advisories reported for the main workspace and the standalone website lockfiles on October 22, 2026. This audit does not cover vulnerabilities in Electron's embedded Node.js runtime.
Product Updates
Desktop
- Upgrade Electron from 41.10.7 to 44.9.3 and update the model-request HTTP client.
Web and Extension
- Update DOMPurify and markdown-it used for rendered content.
Core/Infra
- Update MCP SDK, Vite, Vitest, and vulnerable transitive packages. Update the website's separate dependency lockfile as well.
- Require Node.js 24.22.1 or a newer Node.js 24 patch for development and builds.
Fixes
- Remove vulnerable legacy desktop download dependencies by using the current Electron downloader in electron-builder.
- Upgrade dependencies affected by proxy address parsing, command quoting, selector parsing, archive pattern handling, and MCP advisories.
Breaking Changes / Upgrade Notes
- No user-data migration is required.
- Self-hosted Docker users must pull the new image and recreate their containers; updating Node.js on the host does not update an existing container.
- Desktop users should install this maintenance release for the available Electron and dependency fixes, but must not treat it as a complete fix for the October 21 Node.js vulnerabilities. Follow-up desktop remediation requires an upstream Electron release with those patches.
- Vercel manages Node.js patch versions. Selecting Node.js 24 alone is insufficient evidence of the exact runtime patch.
- On October 22, the checked Vercel production deployment still reported Node.js 24.21.0 after redeployment. The managed function runtime remains pending Vercel's patch rollout; the project's version setting cannot force a specific patch.
Developer Notes
- Pin local and CI Node.js using
.node-version; pin both Docker stages to 24.22.1. - Record runtime versions in server and desktop startup logs for deployment verification.
- Keep targeted transitive overrides until upstream dependencies adopt their patched versions.
Installation guide: English | 中文
Source release notes (EN)
中文
概括
- 将构建、CI 和 Docker 的 Node.js 升级至 24.22.1，纳入 10 月 21 日的安全修复。
- 升级存在已知漏洞的应用与构建依赖，覆盖 Markdown 渲染、内容净化、MCP、Vite 和桌面运行时。
- Electron 44.9.3 内置的仍是 Node.js 24.22.0。桌面端尚需等待包含本次 Node.js 安全修复的上游 Electron 版本。
亮点
- Docker 构建阶段与运行阶段均使用已修补的 Node.js，并重新构建镜像。
- 截至 2026 年 10 月 22 日，主工作区和官网独立锁文件的 npm 已知漏洞审计均已清零；此审计不覆盖 Electron 内置 Node.js 的原生漏洞。
产品更新
Desktop
- Electron 从 41.10.7 升级至 44.9.3，并更新模型请求使用的 HTTP 客户端。
Web 和 Extension
- 更新用于内容渲染的 DOMPurify 和 markdown-it。
Core/Infra
- 更新 MCP SDK、Vite、Vitest 及存在已知漏洞的间接依赖，同时更新官网的独立锁文件。
- 开发和构建要求使用 Node.js 24.22.1 或更新的 Node.js 24 补丁版本。
修复
- 将 electron-builder 使用的 Electron 下载器更新至当前版本，移除存在漏洞的旧下载依赖链。
- 升级受代理地址解析、命令参数引用、CSS 选择器解析、归档匹配和 MCP 安全公告影响的依赖。
破坏性变更 / 升级说明
- 无需迁移用户数据。
- Docker 自部署用户需要拉取新镜像并重新创建容器；更新宿主机 Node.js 不会更新已有容器。
- 桌面用户可安装本次维护版本以获得已有的 Electron 和依赖修复，但不能据此认定 10 月 21 日的 Node.js 漏洞已全部修复；后续仍需升级至包含这些补丁的 Electron 版本。
- Vercel 自动管理 Node.js 补丁版本，仅选择 Node.js 24 不能证明实际运行时已达到指定补丁版本。
- 10 月 22 日核验的 Vercel 生产部署在重新发布后仍报告 Node.js 24.21.0。托管函数运行时尚待 Vercel 推送补丁，项目版本设置无法强制指定补丁版本。
开发者说明
- 使用
.node-version固定本地与 CI 的 Node.js，并将 Docker 两个阶段固定为 24.22.1。 - 在服务端和桌面启动日志中记录运行时版本，便于核验实际部署。
- 在上游依赖采用修补版本前保留必要的间接依赖覆盖。
安装文档：English | 中文
仓库版本说明（中文）
macOS note: if macOS reports the app as damaged or cannot verify the developer, this is usually caused by the quarantine attribute on downloaded apps. See the installation guide, or remove it after installing with xattr -rd com.apple.quarantine /Applications/PromptOptimizer.app; for a downloaded DMG, you can run the same command on ~/Downloads/PromptOptimizer-*.dmg before installing.
macOS 备注：如果 macOS 提示“已损坏”或“无法验证开发者”，通常是下载文件的隔离属性导致。请参考安装文档；也可以在安装后执行 xattr -rd com.apple.quarantine /Applications/PromptOptimizer.app，或在安装前对 ~/Downloads/PromptOptimizer-*.dmg 执行同类命令。