Skip to content

Conversation

@devin-ai-integration
Copy link
Contributor

Description

Upgrades the Node.js version in the sign-client Dockerfile from node:21-alpine to node:22.22.0-alpine to address a critical security vulnerability affecting virtually every production Node.js app.

Reference: https://x.com/matteocollina/status/2011137343323865196

Patched Node.js versions are: 20.20.0, 22.22.0, 24.13.0, 25.3.0. Node.js 21 is not in the patched versions list, so upgrading to 22.22.0 is required.

Type of change

  • Chore (non-breaking change that addresses non-functional tasks, maintenance, or code quality improvements)

How has this been tested?

The Docker image tag node:22.22.0-alpine has been verified to exist on Docker Hub. Full testing should be performed by CI to ensure the Docker build succeeds with the new Node.js version.

Checklist

  • I have performed a self-review of my own code
  • My changes generate no new warnings
  • Any dependent changes have been merged and published in downstream modules

Human Review Checklist

  • Verify the Docker image builds successfully with Node.js 22.22.0
  • Confirm there are no Node.js 21 → 22 breaking changes affecting this package
  • Validate that canary tests pass with the updated image

Additional Information

Addresses critical Node.js security vulnerability affecting production apps.
See: https://x.com/matteocollina/status/2011137343323865196

Patched versions: Node.js 20.20.0, 22.22.0, 24.13.0, 25.3.0
Previous version (21) is not in the patched list.

Co-Authored-By: Ben Kremer <[email protected]>
@devin-ai-integration
Copy link
Contributor Author

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment and CI monitoring

@bkrem bkrem requested review from ganchoradkov and removed request for bkrem January 15, 2026 08:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants