Skip to content

fix: bump node from 24-alpine to 26-alpine #648

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

fix: bump node from 24-alpine to 26-alpine #648

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
# here; the runtime stage below copies out only the finished tree, so npm and its dependencies never
# reach the published image. npm accounted for 38 of the 59 HIGH/CRITICAL findings in the old image
# (a vendored tar, pacote, sigstore, minimatch) and nothing at runtime ever invokes it.
FROM node:24-alpine@sha256:e67514e5d0f6c46656005e1b693b2ec9d52e80b641307de684d4a015ba7a4eaf AS builder
FROM node:26-alpine@sha256:2d984a15c9b54fd0aeb608b8e0d0d83529eb34d2966db27a1fb4f1edc3d298a3 AS builder

ARG BUILDPLATFORM
ARG TARGETPLATFORM
Expand Down Expand Up @@ -66,7 +66,7 @@ RUN chmod +x ./update-info.sh \
&& rm -rf .git update-info.sh

# Runtime stage.
FROM node:24-alpine@sha256:e67514e5d0f6c46656005e1b693b2ec9d52e80b641307de684d4a015ba7a4eaf
FROM node:26-alpine@sha256:2d984a15c9b54fd0aeb608b8e0d0d83529eb34d2966db27a1fb4f1edc3d298a3

# `apk upgrade` patches the Alpine packages that the base image itself lags on - at the time of
# writing node:24-alpine still carries an openssl below 3.5.8-r0. dumb-init reaps zombies as PID 1.
Expand Down
Loading