From 657dba023ccb6af3a9cd179ab026ab296288409a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Nov 2026 22:48:31 +0000 Subject: [PATCH 1/3] chore(deps): bump node in /app_tests in the docker-app-tests-major group Bumps the docker-app-tests-major group in /app_tests with 1 update: node. Updates `node` from 22-slim to 25-slim --- updated-dependencies: - dependency-name: node dependency-version: 25-slim dependency-type: direct:production dependency-group: docker-app-tests-major ... Signed-off-by: dependabot[bot] --- app_tests/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app_tests/Dockerfile b/app_tests/Dockerfile index 5b437e9..55afa3f 100644 --- a/app_tests/Dockerfile +++ b/app_tests/Dockerfile @@ -29,7 +29,7 @@ FROM golang:1.27.3 AS golang # ─── Stage: node ────────────────────────────────────────────────────────────── # Node comes from a named stage, not the nodesource install script, so its # version is a FROM tag that Dependabot and the pin checkers can read. -FROM node:22-slim AS node +FROM node:25-slim AS node # ─── Stage: uv ──────────────────────────────────────────────────────────────── # Named stage required — COPY --from does not support ARG variable expansion. From 2b34dfa1fe5cfd141b96fe4a3f78733acaa7ae65 Mon Sep 17 00:00:00 2001 From: lelia <2418071+lelia@users.noreply.github.com> Date: Fri, 6 Nov 2026 17:06:09 -0600 Subject: [PATCH 2/3] chore(deps): move the images to Node.js 24 instead of 25 Node 25 is an odd-numbered release, never LTS, and reached end of life on 2026-06-01; node:25-slim has not been rebuilt since May. Node 24 is LTS and supported until April 2028. Moves all three images together. Dockerfile and Dockerfile.heavy install Node through nodesource, which Dependabot cannot see, so their setup script, version floor and comment move with the app_tests node stage. The version floor is 24.22.1, the first Node 24 release that rejects the compromised eMudhra intermediates. Dependabot now ignores Node major versions for app_tests, so majors move by hand across all three images, and minor and patch updates still arrive. --- .github/dependabot.yml | 7 +++++++ CHANGELOG.md | 2 ++ Dockerfile | 8 ++++---- Dockerfile.heavy | 6 +++--- app_tests/Dockerfile | 2 +- 5 files changed, 17 insertions(+), 8 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1282e12..587860c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -101,6 +101,13 @@ updates: - dependency-name: "node" - dependency-name: "ghcr.io/astral-sh/uv" - dependency-name: "trufflesecurity/trufflehog" + # Node majors move by hand: the Dockerfile and Dockerfile.heavy install + # Node through nodesource, which Dependabot can't see, so all three must + # change together. Dependabot also doesn't know Node's release schedule, + # and would propose odd-numbered majors, which never get LTS. + ignore: + - dependency-name: "node" + update-types: ["version-update:semver-major"] groups: docker-app-tests-minor-patch: patterns: diff --git a/CHANGELOG.md b/CHANGELOG.md index b2dde4e..abb98ba 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). [Network access for Tier 1](docs/parameters.md#network-access-for-tier-1). ### Changed +- The images ship Node.js 24 (LTS, supported until April 2028) instead of + Node.js 22. - The images set `NODE_USE_ENV_PROXY=1`, so Socket Tier 1 honors `HTTPS_PROXY` and `NO_PROXY`. The Socket npm CLI does not apply `HTTPS_PROXY` to its own requests, and Tier 1 behind a proxy failed with `getaddrinfo EAI_AGAIN diff --git a/Dockerfile b/Dockerfile index 99dd236..a18f217 100644 --- a/Dockerfile +++ b/Dockerfile @@ -60,7 +60,7 @@ COPY --from=trivy /usr/local/bin/trivy /usr/local/bin/trivy COPY --from=trufflehog /usr/bin/trufflehog /usr/local/bin/trufflehog COPY --from=opengrep-installer /root/.opengrep /root/.opengrep -# System deps + Node.js 22.x + Socket CLI +# System deps + Node.js 24.x + Socket CLI # ca-certificates must be 20250419+deb13u1 or newer, which drops the roots the # compromised eMudhra intermediates chain to. RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ @@ -73,10 +73,10 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ # vendors certifi 2026.10.19. Upgrade it against the system store fixed above. RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" \ && python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))' -# Node rejects the compromised eMudhra intermediates from 22.23.4. -RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ +# Node rejects the compromised eMudhra intermediates from 24.22.1. +RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \ && apt-get install -y nodejs \ - && node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>22||(a===22&&(b>23||(b===23&&c>=4)))?0:1)' + && node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>24||(a===24&&(b>22||(b===22&&c>=1)))?0:1)' ARG SOCKET_NPM_CLI_VERSION RUN --mount=type=cache,target=/root/.npm \ npm install -g "socket@${SOCKET_NPM_CLI_VERSION}" diff --git a/Dockerfile.heavy b/Dockerfile.heavy index 558dca6..2817c89 100644 --- a/Dockerfile.heavy +++ b/Dockerfile.heavy @@ -43,10 +43,10 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ # vendors certifi 2026.10.19. Upgrade it against the system store fixed above. RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" \ && python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))' -# Node rejects the compromised eMudhra intermediates from 22.23.4. -RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ +# Node rejects the compromised eMudhra intermediates from 24.22.1. +RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \ && apt-get install -y nodejs \ - && node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>22||(a===22&&(b>23||(b===23&&c>=4)))?0:1)' + && node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>24||(a===24&&(b>22||(b===22&&c>=1)))?0:1)' ARG SOCKET_NPM_CLI_VERSION RUN --mount=type=cache,target=/root/.npm \ npm install -g "socket@${SOCKET_NPM_CLI_VERSION}" diff --git a/app_tests/Dockerfile b/app_tests/Dockerfile index 55afa3f..f869940 100644 --- a/app_tests/Dockerfile +++ b/app_tests/Dockerfile @@ -29,7 +29,7 @@ FROM golang:1.27.3 AS golang # ─── Stage: node ────────────────────────────────────────────────────────────── # Node comes from a named stage, not the nodesource install script, so its # version is a FROM tag that Dependabot and the pin checkers can read. -FROM node:25-slim AS node +FROM node:24-slim AS node # ─── Stage: uv ──────────────────────────────────────────────────────────────── # Named stage required — COPY --from does not support ARG variable expansion. From 7e408dd083190870bd80e1598f4b145832a63b14 Mon Sep 17 00:00:00 2001 From: lelia <2418071+lelia@users.noreply.github.com> Date: Fri, 6 Nov 2026 17:06:47 -0600 Subject: [PATCH 3/3] chore(deps): say how Node minor and patch releases arrive --- .github/dependabot.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 587860c..4e06be7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -104,7 +104,8 @@ updates: # Node majors move by hand: the Dockerfile and Dockerfile.heavy install # Node through nodesource, which Dependabot can't see, so all three must # change together. Dependabot also doesn't know Node's release schedule, - # and would propose odd-numbered majors, which never get LTS. + # and would propose odd-numbered majors, which never get LTS. The floating + # node:-slim tag picks up minor and patch releases on every build. ignore: - dependency-name: "node" update-types: ["version-update:semver-major"]