bug: move Docker base image to node:22.23.2-bookworm (libxml2 CVE-2025-49794)

[devin-ai-integration]

Summary

Fixes Snyk Container finding SNYK-DEBIAN11-LIBXML2-10350665 (CVE-2025-49794, CWE-825 expired pointer dereference in libxml2 XPath/schematron parsing, CVSS 9.1) in the Debian 11 layer pulled in by Dockerfile:2 FROM node:18.13.0 (libxml2 2.9.10+dfsg-6.7+deb11u3).

-FROM node:18.13.0
+FROM node:22.23.2-bookworm

Why Node 22 rather than a newer 18.x tag (the approach used by sibling base-image PRs #118/#120/#147-#150/#253-#255):

• The Debian fix for this CVE is 2.9.14+dfsg-1.3~deb12u3 on bookworm (+deb11u8 on bullseye). Node 18 is EOL and its images stopped being rebuilt in spring 2025 — the last node:18.20.8-bookworm image (docker-library/repo-info, created 2025-03-27) ships libxml2 2.9.14+dfsg-1.3~deb12u1, which is still vulnerable. No node:18.* tag closes this finding.
• node:22.23.2-bookworm (rebuilt 2026-08-25) ships libxml2 2.9.14+dfsg-1.3~deb12u6 (≥ deb12u3 fix). Same tag as bug: upgrade Docker base image to node:22.23.2-bookworm (CVE-2025-55131) #256, so the two PRs agree if both merge (one-line conflict on FROM with the 18.x sibling PRs).
• Snyk's suggested node:18.20.5-alpine3.19 was not used: it is also a frozen EOL image, and routes/index.js shells out to ImageMagick identify, which the alpine node images don't ship.

NODE_OPTIONS=--openssl-legacy-provider in npm start remains valid on Node 22 (OpenSSL 3). Could not docker build here — the Docker registry is off this session's network allowlist.

Note: the finding is filed against COG-GTM/educational-platform, but that repo has no Dockerfile; the traceability block names COG-GTM/nodejs-goof as the source repo and the quoted FROM node:18.13.0 is this file.

Written by Devin

Devin-Org: engineering