[ralph-bitgo]

What

• Pin both stages of Dockerfile and both stages of integration-tests.Dockerfile to node:22.23.4-alpine@sha256:ce8d97f7cfc7c5386421eb932df20a29df99b1a7f469f6157d5c9956702ffadc, replacing node:22.14.0-alpine@sha256:9bef0ef1e268f60627da9ba7d7605e8831d5b56ad07487d24d1aa386336d1944. The supply-chain pinning pattern and the "To update:" comment are kept; only the version and resolved digest changed.
• Set ENV NODE_VERSION=22.23.4 in the builder stage and .nvmrc to 22.23.4 (was 22.1.0), and refresh the base-image comments — the OpenSSL/CVE-2024-6119 note described the old base and no longer applies.
• Align this repo's own CI Node pins (build-and-test.yaml default input, two setup-node pins in pull_request.yaml) and the README prerequisite to 22.23.4 so dev and CI run the same runtime floor the images ship.
• package.json engines: >=22.12.0 is intentionally unchanged: it is an install-compatibility floor satisfied by 22.23.4, not a runtime selector.

Why

• Business reason (WCN-3304): Node 22.14.0 predates the October 2026 Node.js security releases; 22.23.4 is the supported floor for the 22.x line. This is proactive patching in patch mode — staying on 22.x, no 26 cutover — with no exploitability claim.
• Without the CI pin alignment, PR CI would keep validating 22.14.0 while the images ship 22.23.4, so regressions on the shipped floor would go unnoticed.

Digest attestation

• Resolved from the Docker Hub registry API (Docker-Content-Digest header equals sha256 of the manifest body): node:22.23.4-alpine index digest sha256:ce8d97f7cfc7c5386421eb932df20a29df99b1a7f469f6157d5c9956702ffadc; linux/amd64 manifest digest sha256:b7ef7583bfe52302a002cc282f93fe15b8116688a7304bdc7b459b7cfcf29865. OCI annotations on the amd64 manifest show the image was built 2026-10-21 from nodejs/docker-node 22/alpine3.24.
• Method validated against the retired pin: sha256:9bef0ef1e268f60627da9ba7d7605e8831d5b56ad07487d24d1aa386336d1944 is exactly the index digest that the Dockerfile's documented docker pull --platform linux/amd64 + docker inspect procedure produced for node:22.14.0-alpine — the same digest semantics are preserved. The pin stays at index level, so multi-arch builds (including the documented s390x IBM HPVS build path) keep resolving their platform variant.
• Sandbox limitation, stated explicitly: this agent sandbox cannot docker pull/docker build (the egress proxy returns Forbidden for Docker Hub blob-CDN downloads), so the docker inspect cross-check was not executed here. The digest above is registry-sourced, and this PR's CI image builds resolve it against Docker Hub — a mismatch would fail build-docker-image and integration-test.

Test plan (executed on Node 22.23.x)

• npm ci (native addons such as keccak compile from source) + npm run build — pass on Node v22.23.3
• npm test — 460 passing
• npm run test:integration — 29 passing (recovery, sendMany, key-provider flows)
• Exact-floor attestation on v22.23.4 comes from this PR's CI: build/test on setup-node 22.23.4, integration-test via docker compose -f docker-compose.integ.yml up --build (integration-tests.Dockerfile on the new base), and build-docker-image (production Dockerfile on the new base)
• Host caveat: sandbox nixpkgs provides Node v22.23.3, so local runs cover 22.23.x behavior but not the exact patch; CI runs the exact floor.

Deployment usage (WCN-3707 step 1)

• Confirmed from repo evidence: .github/workflows/release-to-ghcr.yaml builds this exact Dockerfile and publishes ghcr.io/bitgo/advanced-wallets:<version>|latest on release; pull_request.yaml carries packages: read # required for ArgoCD deploy, i.e. the published image is deployed via ArgoCD. There are no in-repo helm/k8s manifests.
• Live-cluster attestation (running node --version, deployed image digest vs. the pinned one, rollback criteria) is intentionally left to the rollout child (WCN-3713), which must record observed runtime evidence — a green build does not attest the runtime.

CI results (observed on this branch)

• on_pr run: Build & Test (CI) / Build, Test, Lint, Commit Lint, License - Fossa Scan, Integration Test (docker-compose build of integration-tests.Dockerfile on the new base + npm run test:integration inside it) and Build the Docker Image (production Dockerfile on the new base) all passed. Audit API Spec also passed.
• Security - Trivy Scan failed on pre-existing dependency state, not on this diff: package-lock.json is byte-identical to master (this diff touches only version-pin and doc files). Findings: follow-redirects@1.16.0 CVE-2026-111755 and CVE-2026-111756 (HIGH, fixed in 1.16.1), a transitive dep via @bitgo-beta/sdk-coin-algo -> stellar-sdk -> axios. The job only runs when package.json/package-lock.json/Dockerfile change, so this PR's Dockerfile edit is what surfaced it. Fixing it needs a dependency bump, which WCN-3304 explicitly scopes out; tracked for a separate change.

Ticket: WCN-3304

[linear-code]

WCN-3304

[zahin-mohammad]

Closing as superseded: the identical Node 22.23.4 bump landed via #291 (merged), and the README prerequisite that only this PR updated is now covered by #292.