fix(docker): upgrade node runtime to 22.23.4

.github/workflows/build-and-test.yaml

@@ -6,7 +6,7 @@ on:
       node-version:
         description: 'Node.js version to use'
         type: string
-        default: '22.14.0'
+        default: '22.23.4'
     secrets:
       fossa-api-key:
         description: 'API key used for Fossa scan'

.github/workflows/pull_request.yaml

@@ -28,7 +28,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22.14.0'
+          node-version: '22.23.4'
           cache: 'npm'
 
       - name: Cache dependencies
@@ -78,7 +78,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '22.14.0'
+          node-version: '22.23.4'
           cache: 'npm'
 
       - name: Install dependencies

.nvmrc

@@ -1 +1 @@
-22.1.0
+22.23.4

Dockerfile

@@ -1,10 +1,10 @@
 # syntax=docker/dockerfile:1.4
 
 # Build stage
-# Using node:22.14.0-alpine with OpenSSL 3.3.3+ to address CVE-2024-6119
+# Using node:22.23.4-alpine (October 2026 Node.js security release)
 # Pinned to AMD64-specific SHA256 digest for supply chain security and deterministic builds
-# To update: docker pull --platform linux/amd64 node:22.14.0-alpine && docker inspect --format='{{index .RepoDigests 0}}' node:22.14.0-alpine
-FROM node:22.14.0-alpine@sha256:9bef0ef1e268f60627da9ba7d7605e8831d5b56ad07487d24d1aa386336d1944 AS builder
+# To update: docker pull --platform linux/amd64 node:22.23.4-alpine && docker inspect --format='{{index .RepoDigests 0}}' node:22.23.4-alpine
+FROM node:22.23.4-alpine@sha256:ce8d97f7cfc7c5386421eb932df20a29df99b1a7f469f6157d5c9956702ffadc AS builder
 
 # Set build-time variables for reproducibility
 ARG NODE_ENV=development
@@ -15,7 +15,7 @@ ARG PORT=3081
 
 # Set environment variables
 ENV NODE_ENV=${NODE_ENV} \
-    NODE_VERSION=22.14.0
+    NODE_VERSION=22.23.4
 
 # Set build-time labels
 LABEL org.opencontainers.image.created=${BUILD_DATE} \
@@ -54,9 +54,9 @@ COPY . .
 RUN npm run build
 
 # Production stage
-# Using node:22.14.0-alpine with OpenSSL 3.3.3+ to address CVE-2024-6119
+# Using node:22.23.4-alpine (October 2026 Node.js security release)
 # Pinned to AMD64-specific SHA256 digest for supply chain security and deterministic builds
-FROM node:22.14.0-alpine@sha256:9bef0ef1e268f60627da9ba7d7605e8831d5b56ad07487d24d1aa386336d1944 AS production
+FROM node:22.23.4-alpine@sha256:ce8d97f7cfc7c5386421eb932df20a29df99b1a7f469f6157d5c9956702ffadc AS production
 
 # Declare build arguments in production stage
 ARG PORT=3081

integration-tests.Dockerfile

@@ -1,5 +1,5 @@
 # Stage 1 — build
-FROM node:22.14.0-alpine@sha256:9bef0ef1e268f60627da9ba7d7605e8831d5b56ad07487d24d1aa386336d1944 AS builder
+FROM node:22.23.4-alpine@sha256:ce8d97f7cfc7c5386421eb932df20a29df99b1a7f469f6157d5c9956702ffadc AS builder
 
 ENV NODE_ENV=test \
     TZ=UTC \
@@ -19,7 +19,7 @@ COPY . .
 RUN npm run build
 
 # Stage 2 — test runner
-FROM node:22.14.0-alpine@sha256:9bef0ef1e268f60627da9ba7d7605e8831d5b56ad07487d24d1aa386336d1944 AS runner
+FROM node:22.23.4-alpine@sha256:ce8d97f7cfc7c5386421eb932df20a29df99b1a7f469f6157d5c9956702ffadc AS runner
 
 ENV NODE_ENV=test \
     TZ=UTC \