From defc32b8d85eaa6f9af77628bbe981b578b864af Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 9 Nov 2026 22:36:33 +0000 Subject: [PATCH] chore(deps): bump the docker-patch-and-minor group across 1 directory with 2 updates Bumps the docker-patch-and-minor group with 2 updates in the /docker directory: node and distroless/nodejs24-debian13. Updates `node` from `06d7adf` to `a34ab6d` Updates `distroless/nodejs24-debian13` from `cb60632` to `088a016` --- updated-dependencies: - dependency-name: node dependency-version: 24-slim dependency-type: direct:production dependency-group: docker-patch-and-minor - dependency-name: distroless/nodejs24-debian13 dependency-version: nonroot dependency-type: direct:production dependency-group: docker-patch-and-minor ... Signed-off-by: dependabot[bot] --- docker/Dockerfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 84e78e89..efaafe2f 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -7,7 +7,7 @@ # pinned by digest. # Stage 1: Install all dependencies (including dev deps) for the build. -FROM node:24-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS deps +FROM node:24-alpine@sha256:a34ab6d7f6f4813f4d0c5469d74685604b962fbdbf5793a7bc7b4998ecb867c8 AS deps WORKDIR /app COPY package.json package-lock.json turbo.json ./ COPY packages/shared/package.json packages/shared/ @@ -46,7 +46,7 @@ RUN if [ "$THINKER_PRICING_SNAPSHOT" != "false" ]; then \ # optionalDependencies; without it, npm hoists @esbuild/linux-x64 (a Go # binary) into node_modules even though `--omit=dev` strips its parent, # and CVE scanners then flag the embedded Go stdlib. -FROM node:24-slim@sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205 AS prod-deps +FROM node:24-slim@sha256:01d566e8d94d8c619591d78652babfccd3c6992a3dffa9ed5ab39e11cf6c70e9 AS prod-deps WORKDIR /app RUN mkdir -p /app/request-recordings COPY package.json package-lock.json ./ @@ -77,7 +77,7 @@ RUN --mount=type=cache,target=/root/.npm \ # Stage 4: Distroless runtime. Runs as the built-in `nonroot` user (UID # 65532) by default. No shell, no apk/apt, minimal CVE surface. -FROM gcr.io/distroless/nodejs24-debian13:nonroot@sha256:cb606325b7ec4af55462cb0b424a53b452a5b4a894ffe841fcf1048d216fb9f8 AS runtime +FROM gcr.io/distroless/nodejs24-debian13:nonroot@sha256:088a01637f22908632ba09018be2e0b516f2fa6f7869c191d29491139db43c78 AS runtime WORKDIR /app # No base.digest label: a hand-written digest drifts from the FROM pin above