#ci-runners
Tagged “ci-runners”
4 articlesOctober's Node.js fixes have to land in Azure Pipelines more than once
Node.js shipped fixes for 10 vulnerabilities on October 21, and Microsoft's follow-up guidance for Azure DevOps shows that the agent, pipeline-selected Node.js versions, task extensions and deployed applications each need their own update.
Nov 7, 2026 · Maya OkonkwoSecurity & supply chainGitHub's package firewall puts a policy check between your runners and npm
GitHub has opened a package firewall in public preview for Enterprise Cloud customers. It sits between endpoints and upstream registries and checks npm metadata requests and downloads against enterprise policy before anything installs.
Oct 22, 2026 · Priya NairRunners & infrastructureA slimmer Dragonfly for teams who just want faster image pulls
A CNCF post walks through a lightweight Dragonfly install that keeps peer-to-peer image and file distribution, but drops the Manager, MySQL and Redis. If registry pulls are your CI's slowest step, this is the shape of Dragonfly worth trying first.
Aug 24, 2026 · Priya NairSecurity & supply chainDocker's fourth horror story revisits the Nx post-install hook that drained CI secrets
The fourth installment of Docker's Coding Agent Horror Stories, published July 28, revisits the August 2025 s1ngularity compromise of the Nx npm package. The lesson for CI/CD teams has nothing to do with coding agents. It is about the post-install hook that ran telemetry.js on every runner that pulled the package.
Jul 29, 2026 · Tomás Vega