[peakematt]

Summary

Follow-up to #8. Dockerfile and Dockerfile.dev still built from node:18-alpine, which is EOL and got no patch for the November 2026 Node security release. This moves all of their stages to the official node:22.23.5-alpine image, which Docker Hub published on Nov 11. That matches .nvmrc and the CI matrix from #8.

Review notes

• Node 22 already runs this repo's CI (from Pin Node to 22.23.5 for the November 2026 security release #8), so no code changes should be needed.
• Anything that deploys this image needs a rebuild and redeploy to pick up the patched Node.

Link to Devin session: https://app.devin.ai/sessions/827b6f7f4f5c4db69b167f83971f02df
Open in Devin Desktop: https://app.devin.ai/desktop/session/827b6f7f4f5c4db69b167f83971f02df?variant=devin
Requested by: @peakematt

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from Matt Peake

SYSTEM:
<latest_message>
Matt Peake (U0BQ539BLBG) [ts=1794400900.139529]: @Devin NodeJS announced that they are going to release security updates today or tomorrow: <https://nodejs.org/en/blog/vulnerability/november-2026-security-releases|nodejs.org/en/blog/vulnerability/november-2026-security-releases>.

Set up an automation that checks for the Node security release every 15 minutes until it is announced. Once it is announced, read the notion page linked in this thread and issue PRs on all of the repos described in that notion doc to update node. Add links to PRs and update the status field in Notion accordingly.
</latest_message>

=== BEGIN THREAD HISTORY (in #team-security) ===
Matt Peake (U0BQ539BLBG) [ts=1794400756.414429]: November 2026 NodeJS Updates 🧵

Matt Peake (U0BQ539BLBG) [ts=1794400768.394649]: Tracking sheet: <https://app.notion.com/p/workos/Node-js-security-release-rollout-November-2026-847d458aea8b83649076810cd59daea0?source=copy_link|app.notion.com/p/workos/Node-js-security-release-rollout-November-2026…?source=copy_link>

:large_green_circle: Node.js security release rollout - November 2026

Matt Peake (U0BQ539BLBG) [ts=1794400900.139529]: @Devin NodeJS announced that they are going to release security updates today or tomorrow: <https://nodejs.org/en/blog/vulnerability/november-2026-security-releases|nodejs.org/en/blog/vulnerability/november-2026-security-releases>.

Set up an automation that checks for the Node security release every 15 minutes until it is announced. Once it is announced, read the notion page linked in this thread and issue PRs on all of the repos described in that notion doc to update node. Add links to PRs and update the status field in Notion accordingly.

[Slack unfurl — this is an automatic link preview, not a user message]
Preview of a link: https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
> # nodejs.org
> #``# [Node.js — Wednesday, November 11, 2026 Security Releases](https://nodejs.org/en/blo... (811 chars truncated...)