bug: upgrade Docker base image to node:22.23.2-bookworm (CVE-2025-55131)

[devin-ai-integration]

Summary

Fixes Snyk Container finding SNYK-UPSTREAM-NODE-14928492 (CVE-2025-55131, CWE-362 race condition, CVSS 9.2) in the Node.js runtime itself, pulled in by Dockerfile:2 FROM node:18.13.0.

The vulnerable component is node (not an OS package), and the fix only exists in 20.20.0 / 22.22.0 / 24.13.0 / 25.3.0 — no 18.x release is patched (Node 18 is EOL), so the sibling base-image PRs that move to node:18.20.8-bookworm (#118/#120/#147/#150) do NOT close this finding. This PR moves to node:22.23.2-bookworm:

-FROM node:18.13.0
+FROM node:22.23.2-bookworm

• 22.x = current LTS ("jod"), 22.23.2 ≥ 22.22.0 fix line; tag confirmed in docker-library/official-images library/node.
• -bookworm (Debian 12) matches the OS layer chosen by the sibling base-image PRs, so this also supersedes their Debian 11 package fixes if merged first (expect a trivial one-line conflict with them on this same FROM line).
• Snyk's suggested node:18.20.5-alpine3.19 was NOT used: it stays on Node 18 and would leave this CVE open.
• NODE_OPTIONS=--openssl-legacy-provider in npm start still applies on Node 22 (OpenSSL 3). Sanity check: app.js boots under Node 20.20.2 locally (only the MongoDB/MySQL connections fail, as expected without databases). Could not docker build here — the Docker registry is off the network allowlist.

Written by Devin

Devin-Org: engineering