[Arvion] Security feat: support node 23

Author: arvion-agent

Dockerfile

@@ -3,15 +3,14 @@
 ARG PUSH_SENTRY_RELEASE="false"
 
 # Build step #1: build the React front end
-FROM node:22-alpine AS build-step
+FROM node:23-alpine AS build-step
 ARG SENTRY_RELEASE=""
 WORKDIR /app
 ENV PATH=/app/node_modules/.bin:$PATH
 COPY craco.config.js package.json package-lock.json tsconfig.json tsconfig.paths.json .env.production* ./
 COPY ./src ./src
 COPY ./public ./public
 COPY ./config ./config
-
 RUN npm install
 RUN touch .env.production
 ENV REACT_APP_SENTRY_RELEASE=$SENTRY_RELEASE
@@ -31,17 +30,23 @@ RUN sentry-cli releases finalize ${SENTRY_RELEASE}
 RUN touch sentry
 
 # Build step #3: build the API with the client as static files
-FROM python:3.13 AS false
+FROM python:3.13-alpine AS api-build
 ARG SENTRY_RELEASE=""
 WORKDIR /app
-COPY --from=build-step /app/build ./build
 
+# Install pipx and ensure the path is set correctly
+RUN apk add --no-cache python3 py3-pip py3-virtualenv
+RUN pip install --no-cache-dir pipx && python3 -m pipx ensurepath
+
+COPY --from=build-step /app/build ./build
 RUN rm ./build/static/js/*.map
 RUN mkdir ./api && mkdir ./migrations
 COPY requirements.txt api/ ./api/
 COPY migrations/ ./migrations/
 COPY ./config ./config
-RUN pip install -r ./api/requirements.txt
+
+# Use pipx to install dependencies
+RUN pipx install -r ./api/requirements.txt
 
 # Build an image that includes the optional sentry release push build step
 FROM false AS true