From 651eb0c8341e6105ebae834df1d92b0b0afd806e Mon Sep 17 00:00:00 2001 From: Evan Vetere Date: Wed, 21 Oct 2026 19:34:17 -0400 Subject: [PATCH] fix: Pin the backend image to Node 24.22.1 The October 2026 Node.js security release ships 24.22.1. The backend image followed the floating Node 24 tag, so the patch reached it only on whatever rebuild happened to pull a fresh base, and nothing showed which Node a given image ran. Pin every stage to node:24.22.1-trixie-slim. The exact tag makes the running Node version visible in the Dockerfile and lets Renovate propose each later Node 24 patch as its own change. --- packages/backend/Dockerfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/backend/Dockerfile b/packages/backend/Dockerfile index 4e7d81d..b145ad4 100644 --- a/packages/backend/Dockerfile +++ b/packages/backend/Dockerfile @@ -7,7 +7,7 @@ # See https://backstage.io/docs/deployment/docker#multi-stage-build # Stage 1 - Create yarn install skeleton layer -FROM node:24-trixie-slim AS packages +FROM node:24.22.1-trixie-slim AS packages WORKDIR /app COPY backstage.json package.json yarn.lock ./ @@ -21,7 +21,7 @@ COPY plugins plugins RUN find packages \! -name "package.json" -mindepth 2 -maxdepth 2 -exec rm -rf {} \+ # Stage 2 - Install dependencies and build packages -FROM node:24-trixie-slim AS build +FROM node:24.22.1-trixie-slim AS build # Set Python interpreter for `node-gyp` to use ENV PYTHON=/usr/bin/python3 @@ -59,7 +59,7 @@ RUN mkdir packages/backend/dist/skeleton packages/backend/dist/bundle \ && tar xzf packages/backend/dist/bundle.tar.gz -C packages/backend/dist/bundle # Stage 3 - Build the actual backend image and install production dependencies -FROM node:24-trixie-slim +FROM node:24.22.1-trixie-slim # Set Python interpreter for `node-gyp` to use ENV PYTHON=/usr/bin/python3