chore(deps): bump node from ffc7838 to deae974 in /frontend in the frontend-docker-base-images group - #1221
Conversation
Bumps the frontend-docker-base-images group in /frontend with 1 update: node. Updates `node` from `ffc7838` to `deae974` --- updated-dependencies: - dependency-name: node dependency-version: 26-slim dependency-type: direct:production dependency-group: frontend-docker-base-images ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughChangesFrontend image
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/Dockerfile`:
- Line 1: Update the frontend Docker base-image digest in the FROM declaration
and both frontend OCI metadata blocks in docker-publish.yml to one shared
intended digest, then update the governance test to assert exact equality across
all references.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 87bbdcd9-22ac-432e-b0b2-1c4f0d512ca2
📒 Files selected for processing (1)
frontend/Dockerfile
| @@ -1,4 +1,4 @@ | |||
| FROM node:26-slim@sha256:ffc78385a788964bb3cbab5e434ff79a10bdc25b8ae6db03fe5fe6cb14053c09 | |||
| FROM node:26-slim@sha256:deae974a69e140f44f434ab29cb519fb5f8fe250fd364b8ca446bd0761acdc6a | |||
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- AGENTS.md files ---'
find .. -name AGENTS.md -print
printf '%s\n' '--- root and frontend guidance ---'
for f in AGENTS.md frontend/AGENTS.md; do
if [ -f "$f" ]; then
echo "### $f"
cat "$f"
fi
done
printf '%s\n' '--- relevant files ---'
sed -n '1,120p' frontend/Dockerfile
sed -n '60,95p' .github/workflows/docker-publish.yml
printf '%s\n' '--- governance references ---'
rg -n -C 3 'OCI_IMAGE_BASE|base_digest|node:26-slim|191ef878|deae974a' backend/tests .github frontendRepository: ContextualWisdomLab/naruon
Length of output: 50382
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- focused Dockerfile lines ---'
nl -ba frontend/Dockerfile | sed -n '1,22p'
printf '%s\n' '--- focused workflow references ---'
rg -n -C 5 'base_digest|node:26-slim|191ef878|deae974a' .github/workflows/docker-publish.yml
printf '%s\n' '--- focused governance test references ---'
rg -n -C 8 'base_digest|OCI_IMAGE_BASE|node:26-slim|digest|Dockerfile' backend/tests/test_release_governance.py
printf '%s\n' '--- parsed digest consistency ---'
python3 - <<'PY'
from pathlib import Path
import re
paths = ["frontend/Dockerfile", ".github/workflows/docker-publish.yml", "backend/tests/test_release_governance.py"]
for path in paths:
text = Path(path).read_text()
digests = sorted(set(re.findall(r"sha256:[0-9a-f]{64}", text)))
print(path, digests)
dockerfile = Path("frontend/Dockerfile").read_text()
from_digest = re.search(r"^FROM\s+node:26-slim@(sha256:[0-9a-f]{64})$", dockerfile, re.M)
base_digest = re.search(r'^ARG OCI_IMAGE_BASE_DIGEST="(sha256:[0-9a-f]{64})"$', dockerfile, re.M)
base_name = re.search(r'^ARG OCI_IMAGE_BASE_NAME="docker.io/library/node:26-slim@(sha256:[0-9a-f]{64})"$', dockerfile, re.M)
print("FROM digest:", from_digest.group(1) if from_digest else None)
print("OCI_IMAGE_BASE_DIGEST:", base_digest.group(1) if base_digest else None)
print("OCI_IMAGE_BASE_NAME digest:", base_name.group(1) if base_name else None)
PYRepository: ContextualWisdomLab/naruon
Length of output: 14334
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import json
import re
import urllib.parse
import urllib.request
repo = "library/node"
tag = "26-slim"
digests = [
"sha256:deae974a69e140f44f434ab29cb519fb5f8fe250fd364b8ca446bd0761acdc6a",
"sha256:191ef878ecb351d68b78219593de18bd8942afd59af59f29960dc4b24805a3f1",
]
token_url = "https://auth.docker.io/token?" + urllib.parse.urlencode({
"service": "registry.docker.io",
"scope": f"repository:{repo}:pull",
})
with urllib.request.urlopen(token_url, timeout=20) as response:
token = json.load(response)["token"]
base = f"https://registry-1.docker.io/v2/{repo}/manifests/"
accept = ", ".join([
"application/vnd.oci.image.index.v1+json",
"application/vnd.docker.distribution.manifest.list.v2+json",
"application/vnd.oci.image.manifest.v1+json",
"application/vnd.docker.distribution.manifest.v2+json",
])
headers = {"Authorization": f"Bearer {token}", "Accept": accept}
def get_manifest(ref):
request = urllib.request.Request(base + ref, headers=headers)
with urllib.request.urlopen(request, timeout=20) as response:
body = response.read()
return response.headers.get("Docker-Content-Digest"), response.headers.get("Content-Type"), json.loads(body)
tag_digest, tag_type, tag_manifest = get_manifest(tag)
print("tag", tag, "header_digest", tag_digest, "content_type", tag_type)
print("tag_manifest_digest", tag_manifest.get("digest"))
for digest in digests:
resolved, content_type, manifest = get_manifest(digest)
print("ref", digest, "header_digest", resolved, "content_type", content_type)
print(" mediaType", manifest.get("mediaType"))
if "manifests" in manifest:
print(" child_manifests", len(manifest["manifests"]))
print(" matches_tag_child_set", {
(item.get("digest"), item.get("platform", {}).get("architecture"), item.get("platform", {}).get("os"))
for item in manifest["manifests"]
} == {
(item.get("digest"), item.get("platform", {}).get("architecture"), item.get("platform", {}).get("os"))
for item in tag_manifest.get("manifests", [])
})
print(" equals_tag_header_digest", digest == tag_digest)
PYRepository: ContextualWisdomLab/naruon
Length of output: 2451
🌐 Web query:
"sha256:deae974a69e140f44f434ab29cb519fb5f8fe250fd364b8ca446bd0761acdc6a" node 26 slim
💡 Result:
The SHA256 digest sha256:deae974a69e140f44f434ab29cb519fb5f8fe250fd364b8ca446bd0761acdc6a is a valid image digest associated with the official Node.js Docker image, specifically for the slim and trixie-slim variants [1][2][3]. This digest serves as a content-addressable identifier for these specific image tags on Docker Hub [1][2][3]. As of August 2026, it is commonly referenced in the official Node repository for tags such as node:slim and node:trixie-slim [1][2][3]. To use this specific image version, you can pull it by digest to ensure you are running the exact same bits, regardless of tag updates: docker pull node@sha256:deae974a69e140f44f434ab29cb519fb5f8fe250fd364b8ca446bd0761acdc6a
Citations:
- 1: https://hub.docker.com/layers/library/node/slim/images/sha256-00fadb2d0a106a73d2c398e151aad29570abb9e9e08a0f73b4081b44da09cfe9
- 2: https://hub.docker.com/layers/library/node/trixie-slim/images/sha256-69cd4a962efc3dddc1afe63c6dd4be90ef08c76ea84a4efd7abb201e57e926e2
- 3: https://hub.docker.com/_/node
🌐 Web query:
"sha256:191ef878ecb351d68b78219593de18bd8942afd59af59f29960dc4b24805a3f1" node 26 slim
💡 Result:
The SHA-256 hash 191ef878ecb351d68b78219593de18bd8942afd59af59f29960dc4b24805a3f1 refers to a specific image layer digest within the official Node.js Docker library, specifically associated with the linux/ppc64le architecture for various tags of the node:slim image [1][2]. It is not a manifest digest for the entirety of a "node 26 slim" image, but rather a specific component layer found in multi-platform image manifests [1][2]. Official Docker images are multi-architecture; pulling node:26-slim will automatically resolve to the manifest digest appropriate for your specific host system's architecture, rather than this specific layer hash [3][4]. If you are attempting to verify an image, you should compare the full image digest (often provided in the Docker pull output or the Docker Hub "Digest" field) rather than individual layer hashes, as layer hashes may vary between architectures or minor build updates [1][2].
Citations:
- 1: https://hub.docker.com/layers/library/node/slim/images/sha256-b6c561a18551cd80a54e5d2abe88e073e0066ef08dca958f32d7954bb621c83e
- 2: https://hub.docker.com/layers/library/node/trixie-slim/images/sha256:8d3d43f74a7fc66b6fd3a9a51c9db65aea95fb62a99acdc65129407e0a3eb650
- 3: https://hub.docker.com/_/node/?tab=tags
- 4: https://hub.docker.com/_/node?tab=tags
🏁 Script executed:
#!/bin/bash
set -eu
token="$(
curl -ksS --fail \
'https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/node:pull' |
python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])'
)"
accept='application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json'
for ref in 26-slim \
sha256:deae974a69e140f44f434ab29cb519fb5f8fe250fd364b8ca446bd0761acdc6a \
sha256:191ef878ecb351d68b78219593de18bd8942afd59af59f29960dc4b24805a3f1; do
echo "### $ref"
curl -ksS --fail \
-H "Authorization: Bearer $token" \
-H "Accept: $accept" \
-D /tmp/node-manifest-headers \
"https://registry-1.docker.io/v2/library/node/manifests/$ref" \
-o /tmp/node-manifest.json
grep -iE '^(docker-content-digest|content-type):' /tmp/node-manifest-headers || true
python3 - <<'PY'
import json
from pathlib import Path
m = json.loads(Path("/tmp/node-manifest.json").read_text())
print("mediaType:", m.get("mediaType"))
print("schemaVersion:", m.get("schemaVersion"))
print("manifest_count:", len(m.get("manifests", [])))
for item in m.get("manifests", []):
platform = item.get("platform", {})
print(item.get("digest"), platform.get("os"), platform.get("architecture"), platform.get("variant"))
PY
doneRepository: ContextualWisdomLab/naruon
Length of output: 278
Synchronize the base-image digest across all references.
frontend/Dockerfile uses a different digest in FROM than its OCI metadata. Both frontend metadata blocks in .github/workflows/docker-publish.yml use the old digest. Use one intended digest in all references and assert exact equality in the governance test.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@frontend/Dockerfile` at line 1, Update the frontend Docker base-image digest
in the FROM declaration and both frontend OCI metadata blocks in
docker-publish.yml to one shared intended digest, then update the governance
test to assert exact equality across all references.
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Closing as a strict subset of #1220, which updates the same frontend Node digest together with the synchronized Python and Ollama base-image pins. Keeping both open would duplicate validation and create an avoidable merge-order conflict.
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
1 participant
Bumps the frontend-docker-base-images group in /frontend with 1 update: node.
Updates
nodefromffc7838todeae974Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by CodeRabbit