From d9c25ea6ac1c68de98821792336e5da0d7e8ca52 Mon Sep 17 00:00:00 2001
From: Zahin Mohammad <zahinmohammad@bitgo.com>
Date: Wed, 21 Oct 2026 16:02:54 -0400
Subject: [PATCH] fix(docker): upgrade node runtime to 22.23.4

Bump the builder and production images, the integration-tests image,
.nvmrc and the CI node-version pins from 22.14.0 (22.1.0 for .nvmrc) to
22.23.4, the supported 22.x floor containing the October 2026 Node.js
security fixes. Image digests are re-pinned to the digest resolved for
node:22.23.4-alpine.

Ticket: WCN-3304

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/build-and-test.yaml |  2 +-
 .github/workflows/pull_request.yaml   |  4 ++--
 .nvmrc                                |  2 +-
 Dockerfile                            | 12 ++++++------
 integration-tests.Dockerfile          |  4 ++--
 5 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/build-and-test.yaml b/.github/workflows/build-and-test.yaml
index 356ae4a4..c360e16f 100644
--- a/.github/workflows/build-and-test.yaml
+++ b/.github/workflows/build-and-test.yaml
@@ -6,7 +6,7 @@ on:
       node-version:
         description: 'Node.js version to use'
         type: string
-        default: '22.14.0'
+        default: '22.23.4'
     secrets:
       fossa-api-key:
         description: 'API key used for Fossa scan'
diff --git a/.github/workflows/pull_request.yaml b/.github/workflows/pull_request.yaml
index 7549f549..cf185d04 100644
--- a/.github/workflows/pull_request.yaml
+++ b/.github/workflows/pull_request.yaml
@@ -28,7 +28,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22.14.0'
+          node-version: '22.23.4'
           cache: 'npm'
 
       - name: Cache dependencies
@@ -78,7 +78,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '22.14.0'
+          node-version: '22.23.4'
           cache: 'npm'
 
       - name: Install dependencies
diff --git a/.nvmrc b/.nvmrc
index ee5c2446..b8b23ca9 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-22.1.0
+22.23.4
diff --git a/Dockerfile b/Dockerfile
index 9e79e914..9713aac0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,10 @@
 # syntax=docker/dockerfile:1.4
 
 # Build stage
-# Using node:22.14.0-alpine with OpenSSL 3.3.3+ to address CVE-2024-6119
+# Using node:22.23.4-alpine (October 2026 Node.js security release)
 # Pinned to AMD64-specific SHA256 digest for supply chain security and deterministic builds
-# To update: docker pull --platform linux/amd64 node:22.14.0-alpine && docker inspect --format='{{index .RepoDigests 0}}' node:22.14.0-alpine
-FROM node:22.14.0-alpine@sha256:9bef0ef1e268f60627da9ba7d7605e8831d5b56ad07487d24d1aa386336d1944 AS builder
+# To update: docker pull --platform linux/amd64 node:22.23.4-alpine && docker inspect --format='{{index .RepoDigests 0}}' node:22.23.4-alpine
+FROM node:22.23.4-alpine@sha256:ce8d97f7cfc7c5386421eb932df20a29df99b1a7f469f6157d5c9956702ffadc AS builder
 
 # Set build-time variables for reproducibility
 ARG NODE_ENV=development
@@ -15,7 +15,7 @@ ARG PORT=3081
 
 # Set environment variables
 ENV NODE_ENV=${NODE_ENV} \
-    NODE_VERSION=22.14.0
+    NODE_VERSION=22.23.4
 
 # Set build-time labels
 LABEL org.opencontainers.image.created=${BUILD_DATE} \
@@ -54,9 +54,9 @@ COPY . .
 RUN npm run build
 
 # Production stage
-# Using node:22.14.0-alpine with OpenSSL 3.3.3+ to address CVE-2024-6119
+# Using node:22.23.4-alpine (October 2026 Node.js security release)
 # Pinned to AMD64-specific SHA256 digest for supply chain security and deterministic builds
-FROM node:22.14.0-alpine@sha256:9bef0ef1e268f60627da9ba7d7605e8831d5b56ad07487d24d1aa386336d1944 AS production
+FROM node:22.23.4-alpine@sha256:ce8d97f7cfc7c5386421eb932df20a29df99b1a7f469f6157d5c9956702ffadc AS production
 
 # Declare build arguments in production stage
 ARG PORT=3081
diff --git a/integration-tests.Dockerfile b/integration-tests.Dockerfile
index 05163811..bf4de996 100644
--- a/integration-tests.Dockerfile
+++ b/integration-tests.Dockerfile
@@ -1,5 +1,5 @@
 # Stage 1 — build
-FROM node:22.14.0-alpine@sha256:9bef0ef1e268f60627da9ba7d7605e8831d5b56ad07487d24d1aa386336d1944 AS builder
+FROM node:22.23.4-alpine@sha256:ce8d97f7cfc7c5386421eb932df20a29df99b1a7f469f6157d5c9956702ffadc AS builder
 
 ENV NODE_ENV=test \
     TZ=UTC \
@@ -19,7 +19,7 @@ COPY . .
 RUN npm run build
 
 # Stage 2 — test runner
-FROM node:22.14.0-alpine@sha256:9bef0ef1e268f60627da9ba7d7605e8831d5b56ad07487d24d1aa386336d1944 AS runner
+FROM node:22.23.4-alpine@sha256:ce8d97f7cfc7c5386421eb932df20a29df99b1a7f469f6157d5c9956702ffadc AS runner
 
 ENV NODE_ENV=test \
     TZ=UTC \