Replay · real items, sample repos, no LLM involved

Node.js security releases, October 2026: what Briff would have sent

Node.js pre-announced security releases for the 26.x, 24.x and 22.x lines a week ahead, then rewrote the same post on release day with 22.23.4, 24.22.1 and 26.12.1. Six repos from a real stack: floating and pinned images, an engines range, and two end-of-life lines (node 18, node 14). Below are the 3 emails Briff would have sent, each rendered by the production template.

›Sample repos (6)
  • briff
    Dockerfile: FROM node:22-alpine
package.json: {"engines":{"node":">=22.12"}}
    Scanned: node 22 (Dockerfile), node 22.12+ (package.json engines.node)
  • garden.example
    Dockerfile: FROM node:22.17.0-alpine
    Scanned: node 22.17.0 (Dockerfile)
  • sigma/forms-web
    Dockerfile: FROM node:24.15.0-alpine
    Scanned: node 24.15.0 (Dockerfile)
  • sigma/budget
    Dockerfile: FROM node:24-slim
    Scanned: node 24 (Dockerfile)
  • bakery.example
    Dockerfile: FROM node:18-alpine
    Scanned: node 18 (Dockerfile)
  • orchid-hotel.example
    .nvmrc: v14.15.0
    Scanned: node 14.15.0 (.nvmrc)

Wed 14 Oct 2026

  1. WHAT HAPPENED

    Node.js pre-announces security releases for 26.x, 24.x and 22.x

    Highest severity HIGH on every line, release on or shortly after Wednesday 21 October. End-of-life lines are always affected.

    nodejs.orgcommit 98eab92

  2. WHAT BRIFF SENT

    Urgent email · +55 min after “Wednesday, October 21, 2026 Security Releases” appeared

    FromBriff
    SubjectBriff · urgent: Wednesday, October 21, 2026 Security Releases

Mon 19 Oct 2026

  1. WHAT BRIFF SENT

    Weekly bulletin · scheduled run, Monday 04:00 UTC

    FromBriff
    SubjectBriff · Weekly · W43: Node.js

Wed 21 Oct 2026

  1. WHAT HAPPENED

    Node.js 22.23.4, 24.22.1 and 26.12.1 are out

    Ten CVEs, four rated high, among them a Brotli decoder out-of-bounds write (CVE-2026-111497) and TLS hostname bypasses. The announcement post is rewritten in place.

    nodejs.orgcommit b58692e

  2. WHAT BRIFF SENT

    Urgent email · +52 min after “Wednesday, October 21, 2026 Security Releases” appeared

    FromBriff
    SubjectBriff · urgent · fix released: Wednesday, October 21, 2026 Security Releases

The items are the ones the sources published, with their dates, read by the same parsers and extractors Briff runs in production. The worker's hourly collect is replayed with a fake clock: an item is collected by the first run after it appeared, matched to the sample repos by runtime, and the urgent pass and the weekly assembly run unchanged. Urgent emails never use a model. In the weekly bulletin the model writes the headline and one line; here the item title stands in, and the action is the deterministic one in both cases.

Run it yourself:

npm run replay -- node-oct-2026 --out docs/replay/node-oct-2026.html