Pin production Node 22.23.4 after October security release #271

Finding and source correction

The original production image copied Node from a mutable asset stage. The
October 21 security release fixes the affected 22.x line in Node 22.23.4:
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

PRs #270 and #272 delivered the reviewed immutable Node 22.23.4 input and actual
effective-trust guards for both production and development source at main
910f928db35d37fd142e3921b2ee11ae2901d727, exact qualified tree
ddbea538b1faf41a5c091641b8de71fcfe118357. All 28 candidate checks passed.

The independent system Brotli correction is source-merged through #273. It uses the
reviewed same-base Debian backport and actual final-runtime guards, keeping
Node's embedded decoder check separate. The final candidate's 28 checks pass,
including native production smoke on amd64/arm64 and devcontainer qualification.
Source is merged normally at 922e0c54b5086823de44cf76a9f9aa4066ac920b,
with exact qualified tree 23bec5e4910f05972fc870cb0a453431685abbb2.
The merged remote head is deleted and its absence verified. Fresh main checks
remain separate. The existing devcontainer publisher run 39872797679 passes
all six jobs on that exact merge, finishing 23:51:52 UTC. Both native builds
and actual published-image qualifications pass before main-channel promotion
to GHCR and Docker Hub. The current multi-platform index is
sha256:3047c6f9945b27471a396dc4e145809be975967ac67b3533b019a5a253291b21.
The prior main image publisher was cancelled
before mutable-channel promotion, so its immutable outputs are not current
published acceptance. No evidence of exploitation is claimed.

Current #273 source is 82547b344da0909403aaf17e246d4cf75c6d8d75, whole
23bec5e4910f05972fc870cb0a453431685abbb2. The prior 31f image build failed
when developer-role readiness tried to read a root-owned PHP build source.
The hosted log establishes permission denial at that file. Complete inventory
remains mandatory in the image build and runs explicitly as root during image
qualification; developer readiness stays unprivileged. A new role contract
fails prior source and passes after correction. Nine focused tests / 56
assertions pass. Exact-head Sonar and its issue API pass with zero OPEN/CONFIRMED.
The current 28 candidate checks qualify the source; prior architecture passes
are not carried to it, and publication still requires its own acceptance.

Acceptance

• Pin the production asset stage to reviewed Node 22.23.4 slim bytes using an immutable multi-platform digest.
• Verify the actual Node version and effective TLS roots before the first npm network operation.
• Rebuild the final image without stale cache and verify the installed final-runtime node --version is 22.23.4 on each published architecture.
• Run the normal image/startup and Playwright qualification, then record manifest/provenance evidence.
• Determine whether any currently published Sample App image contains an earlier Node 22 build; replace affected mutable channels before further use.
• Qualify the system decoder correction in both PHP image recipes and retain exact package/patch evidence alongside scanner results.

Published acceptance

The immutable tag is
sha-922e0c54b5086823de44cf76a9f9aa4066ac920b-run-39872797679-1.
Published native amd64 and arm64 jobs qualify the actual image, expected source
revision, anonymous pull, attestations, full root decoder inventory,
unprivileged readiness, playground and browser startup. Both jobs pass. The
publisher then promotes and checks both public main indexes. Independent
anonymous manifest reads find the same children in both registries:

• amd64: sha256:0423a1f24f83eb6097815e133cbca712248c808a087ca899cbaf313f0b5c886d
• arm64: sha256:9dd03e6e134e2540d7d77007da27767e7a4d05970eb96531ea314114644ce005

Direct GHCR index inspection confirms the index digest above. A subsequent
extra Docker CLI-container query to Docker Hub timed out after the successful
anonymous read; no registry or runtime cause is inferred. Root Compose images
are built locally by consumers, and both native production source smokes pass;
no new root-image registry is invented.

General's source and current-channel acceptance is complete. Security retains
independent review, and the broader trust/bootstrap obligation in shared #237
remains open. No failed original, historical image or stopped probe is relabelled.