From ad7a265f2bac6eb04eb657c85c50203811e94f19 Mon Sep 17 00:00:00 2001 From: Karl Waldman Date: Sat, 22 Aug 2026 07:19:42 -0400 Subject: [PATCH] fix(docker): move published image to Node 24 LTS, not the EOL Node 25 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependabot PR #72 proposed node:22-alpine -> node:25-alpine. Node 25 is a Current (odd-numbered) release that reached END OF LIFE on 2026-06-01, per nodejs/Release schedule.json — so that bump would have pinned the published container to a runtime receiving no further security patches, five days short of three months after EOL. CI was green because the workflows test the packed npm artifact on Node 18/20/22/24 and never build the Dockerfile. Bump to node:24-alpine instead (Krypton, Active LTS, maintenance 2026-10-20, end 2028-04-30) and tell Dependabot to stop proposing Node majors so the next one is a deliberate move to v26 when it becomes Active LTS on 2026-10-28. Digest-level minor/patch refreshes on the pinned major still come through. Verified locally on 2026-08-22: docker build ... -> success docker run --entrypoint node -> v24.19.0 MCP stdio initialize -> serverInfo {"name":"oilpriceapi","version":"3.2.3"} Closes #72 Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01JKAExynd9zoKwt6rYA66EA --- .github/dependabot.yml | 13 +++++++++++++ Dockerfile | 4 ++-- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d1df17a..1a1e6a5 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -23,3 +23,16 @@ updates: schedule: interval: "weekly" open-pull-requests-limit: 1 + ignore: + # Track the Node LTS line only. Odd-numbered Node majors are "Current" + # releases with a ~7-month support window; Dependabot happily proposes + # them and has already offered one that was ALREADY end-of-life (PR #72 + # proposed node:25-alpine on 2026-08-17; Node 25 reached EOL 2026-06-01 + # per https://github.com/nodejs/Release/blob/main/schedule.json). + # + # Pinning the published image to an EOL runtime means no upstream + # security patches, so ignore majors and bump this deliberately when the + # next LTS (v26, Active LTS from 2026-10-28) is cut. Minor/patch digest + # refreshes on the pinned major still come through. + - dependency-name: "node" + update-types: ["version-update:semver-major"] diff --git a/Dockerfile b/Dockerfile index 8492e12..a796cbf 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS builder +FROM node:24-alpine@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS builder WORKDIR /app @@ -22,7 +22,7 @@ RUN case "$SOURCE_COMMIT" in \ npm prune --omit=dev && \ npm cache clean --force -FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS runtime +FROM node:24-alpine@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS runtime ARG SOURCE_COMMIT LABEL org.opencontainers.image.source="https://github.com/OilpriceAPI/mcp-server" \