[talosmachina]

Outcome

The dashboard image runs on Node.js 24.22.1, the October 21, 2026 security release (HIGH severity fixes in the 24.x line).

What changed

• Dockerfile: both stages pinned from the floating node:24-alpine to node:24.22.1-alpine, so a cached old 24-alpine layer cannot slip through.
• package.json and CHANGELOG.md: release 0.1.33.

Accepts when

• node:24.22.1-alpine is published on Docker Hub (docker-node PR feat: Node.js 22.23.4, 24.22.1, 26.12.1 nodejs/docker-node#2662 merged; image builds were still running when this PR opened)
• CI docker job builds both architectures green on this branch
• Tagging v0.1.33 publishes the image

Evidence

• No testable behaviour: a base image change. The check that applies is the CI image build for amd64 and arm64.
• Node.js lists 24.22.1 as a security release dated 2026-10-20 in https://nodejs.org/dist/index.json.

Risk

Production deploy configuration (the published image's base). No code, dependency or lock file change.

Note: if CI runs before Docker Hub has the tag, the docker job fails on a missing manifest; re-run it once the tag exists.

Requested by @SpontaneousOverthrow via Slack. Owner: @SpontaneousOverthrow.

[SpontaneousOverthrow]

LGTM

[talosmachina]

Thanks @SpontaneousOverthrow. One thing before this merges: the docker check is red, and it is upstream, not the diff.

• The build fails on node:24.22.1-alpine: no match for platform in manifest: not found.
• Docker Hub has the tag (pushed 11:38 UTC today), but its index lists no platform images yet. docker buildx imagetools inspect node:24.22.1-alpine shows an empty manifest list; node:24.22.1 is the same. The official image is still being published.
• Falling back to node:24-alpine is not an option: it still resolves to v24.22.0 (docker run --rm node:24-alpine node -v), the unpatched release.

Nothing to change in the branch. Once the tag carries linux/amd64 and linux/arm64, a re-run of the docker job should go green; I cannot trigger that myself, so a maintainer re-run is needed. Please hold the merge until then.