From 98c29bc1995b18b9546e3153cc877ed96d327b79 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 4 Sep 2026 09:09:46 +0000 Subject: [PATCH] fix: bump node from 24-alpine to 26-alpine Bumps node from 24-alpine to 26-alpine. --- updated-dependencies: - dependency-name: node dependency-version: 26-alpine dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index f6b1a345f..e74410ca7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,7 +11,7 @@ # here; the runtime stage below copies out only the finished tree, so npm and its dependencies never # reach the published image. npm accounted for 38 of the 59 HIGH/CRITICAL findings in the old image # (a vendored tar, pacote, sigstore, minimatch) and nothing at runtime ever invokes it. -FROM node:24-alpine@sha256:e67514e5d0f6c46656005e1b693b2ec9d52e80b641307de684d4a015ba7a4eaf AS builder +FROM node:26-alpine@sha256:2d984a15c9b54fd0aeb608b8e0d0d83529eb34d2966db27a1fb4f1edc3d298a3 AS builder ARG BUILDPLATFORM ARG TARGETPLATFORM @@ -66,7 +66,7 @@ RUN chmod +x ./update-info.sh \ && rm -rf .git update-info.sh # Runtime stage. -FROM node:24-alpine@sha256:e67514e5d0f6c46656005e1b693b2ec9d52e80b641307de684d4a015ba7a4eaf +FROM node:26-alpine@sha256:2d984a15c9b54fd0aeb608b8e0d0d83529eb34d2966db27a1fb4f1edc3d298a3 # `apk upgrade` patches the Alpine packages that the base image itself lags on - at the time of # writing node:24-alpine still carries an openssl below 3.5.8-r0. dumb-init reaps zombies as PID 1.