chore(deps): move the images to Node.js 24

.github/dependabot.yml

@@ -101,6 +101,14 @@ updates:
       - dependency-name: "node"
       - dependency-name: "ghcr.io/astral-sh/uv"
       - dependency-name: "trufflesecurity/trufflehog"
+    # Node majors move by hand: the Dockerfile and Dockerfile.heavy install
+    # Node through nodesource, which Dependabot can't see, so all three must
+    # change together. Dependabot also doesn't know Node's release schedule,
+    # and would propose odd-numbered majors, which never get LTS. The floating
+    # node:<major>-slim tag picks up minor and patch releases on every build.
+    ignore:
+      - dependency-name: "node"
+        update-types: ["version-update:semver-major"]
     groups:
       docker-app-tests-minor-patch:
         patterns:

CHANGELOG.md

@@ -18,6 +18,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   [Network access for Tier 1](docs/parameters.md#network-access-for-tier-1).
 
 ### Changed
+- The images ship Node.js 24 (LTS, supported until April 2028) instead of
+  Node.js 22.
 - The images set `NODE_USE_ENV_PROXY=1`, so Socket Tier 1 honors `HTTPS_PROXY`
   and `NO_PROXY`. The Socket npm CLI does not apply `HTTPS_PROXY` to its own
   requests, and Tier 1 behind a proxy failed with `getaddrinfo EAI_AGAIN

Dockerfile

@@ -60,7 +60,7 @@ COPY --from=trivy      /usr/local/bin/trivy       /usr/local/bin/trivy
 COPY --from=trufflehog /usr/bin/trufflehog        /usr/local/bin/trufflehog
 COPY --from=opengrep-installer /root/.opengrep    /root/.opengrep
 
-# System deps + Node.js 22.x + Socket CLI
+# System deps + Node.js 24.x + Socket CLI
 # ca-certificates must be 20250419+deb13u1 or newer, which drops the roots the
 # compromised eMudhra intermediates chain to.
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
@@ -73,10 +73,10 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
 # vendors certifi 2026.10.19. Upgrade it against the system store fixed above.
 RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" \
     && python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))'
-# Node rejects the compromised eMudhra intermediates from 22.23.4.
-RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+# Node rejects the compromised eMudhra intermediates from 24.22.1.
+RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
     && apt-get install -y nodejs \
-    && node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>22||(a===22&&(b>23||(b===23&&c>=4)))?0:1)'
+    && node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>24||(a===24&&(b>22||(b===22&&c>=1)))?0:1)'
 ARG SOCKET_NPM_CLI_VERSION
 RUN --mount=type=cache,target=/root/.npm \
     npm install -g "socket@${SOCKET_NPM_CLI_VERSION}"

Dockerfile.heavy

@@ -43,10 +43,10 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
 # vendors certifi 2026.10.19. Upgrade it against the system store fixed above.
 RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" \
     && python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))'
-# Node rejects the compromised eMudhra intermediates from 22.23.4.
-RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+# Node rejects the compromised eMudhra intermediates from 24.22.1.
+RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
     && apt-get install -y nodejs \
-    && node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>22||(a===22&&(b>23||(b===23&&c>=4)))?0:1)'
+    && node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>24||(a===24&&(b>22||(b===22&&c>=1)))?0:1)'
 ARG SOCKET_NPM_CLI_VERSION
 RUN --mount=type=cache,target=/root/.npm \
     npm install -g "socket@${SOCKET_NPM_CLI_VERSION}"

app_tests/Dockerfile

@@ -29,7 +29,7 @@ FROM golang:1.27.3 AS golang
 # ─── Stage: node ──────────────────────────────────────────────────────────────
 # Node comes from a named stage, not the nodesource install script, so its
 # version is a FROM tag that Dependabot and the pin checkers can read.
-FROM node:22-slim AS node
+FROM node:24-slim AS node
 
 # ─── Stage: uv ────────────────────────────────────────────────────────────────
 # Named stage required — COPY --from does not support ARG variable expansion.