chore(deps): move the web image's Node base to 24 (Active LTS) - #161
Merged
Conversation
The frontend-builder stage sat on node:20-slim, which went EOL on 2026-04-30 and no longer receives security patches. Dependabot noticed and proposed node:25-slim (#156) -- but 25 is an odd-numbered "Current" release that never becomes LTS and reached EOL on 2026-06-01, so that bump swapped one unpatched base image for another. Node 24 (Krypton) is Active LTS: supported until 2028-04-30, and it does not even enter maintenance until 2026-10-20. Dependabot picks the highest published tag and has no concept of Node's release lines, so it will keep proposing odd majors (26 arrives 2026-10-28, 27 a year later). Ignore semver-major bumps for `node` in the docker ecosystem and pick Node majors by hand on the LTS cadence; minor/patch bumps, which carry the base-image CVE fixes this ecosystem entry was added for, keep flowing untouched. CI's setup-node pin moves 20 -> 24 in the same change: left behind, it would typecheck and build the frontend on a different major than the shipped image builds it with. The two `node:20-slim` strings in tests/image/test_docker_image.py (a module docstring and a skip reason) and the one in dependabot.yml's own comment are updated to match. Verified locally: full multi-stage `docker build -f docker/Dockerfile` succeeds, the built image runs (`remo 4.3.3`) and carries the SPA at /app/frontend-dist; `npm ci && npm run build` is warning-clean on both 24-slim and 25-slim, so this is a support-lifecycle change, not a compatibility fix. Closes #156 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RcgFXhhdqGGzhk5Ardf9rk
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #156.
Why not #156
Dependabot proposed
node:20-slim→node:25-slim. Both tags are end-of-life. From Node's ownschedule.json:Node 25 is a "Current" release that never becomes LTS. Merging #156 would have swapped one unpatched base image for another — the exact failure the docker ecosystem entry added in #154 exists to prevent. Node 24 is supported until 2028-04-30 and doesn't enter maintenance until 2026-10-20.
The move off 20 is overdue regardless; only the target was wrong.
What's here
docker/Dockerfile— frontend-builder stage →node:24-slim.github/workflows/ci.yml—setup-nodepin20→24. Left behind, CI would typecheck and build the frontend on a different major than the shipped image builds it with.tests/image/test_docker_image.py— the two hardcodednode:20-slimstrings (module docstring, skip reason).github/dependabot.yml— the ecosystem comment's stalenode:20-slim.github/dependabot.yml— ignoresemver-majorfornode. Dependabot picks the highest published tag and has no concept of release lines, so it will keep proposing odd majors (26 lands 2026-10-28, 27 a year later). Node majors get picked by hand on the LTS cadence; minor/patch bumps — the ones carrying base-image CVE fixes — keep flowing untouched.Verification
docker build -f docker/Dockerfilesucceeds; the built image runs (remo 4.3.3) and carries the SPA at/app/frontend-distnpm ci && npm run buildis warning-clean (noEBADENGINE) on both 24-slim and 25-slim, producing identicaldist/structure — this is a support-lifecycle change, not a compatibility fixtests/image/21 passed, 14 skipped; frontend typecheck + build clean; both YAML files parse and theignoreentry resolves to exactlynode/version-update:semver-major🤖 Generated with Claude Code
https://claude.ai/code/session_01RcgFXhhdqGGzhk5Ardf9rk