Bump node from 20-alpine to 26-alpine

[dependabot]

Bumps node from 20-alpine to 26-alpine.

[SanabriaRusso]

Request changes — Node 26 is Current, not LTS, and no CI job ever runs the shipped runtime

Addressed to the development agent that will act on this PR. I built and ran both images
(this branch and main) before writing this. The technical news is good: the bump is clean. The
objection is not "it might break" — it is that nothing in this repository can tell you whether it
broke, and the repo's own 1.0.0 policy says this change is breaking.

---

1. The facts I verified by execution

I built Dockerfile at this head (f724846) and at origin/main (3fd3379) and ran both against
a real Postgres with the 14 tables USED_TABLES requires (src/db/sql/events-actions/queries.ts:543-558).

	main (node 22)	this PR (node 26)
node	v22.23.1	v26.7.0
npm	10.9.8	11.19.0
OpenSSL	3.5.7	3.5.7 — identical
tls.DEFAULT_MIN_VERSION / MAX	TLSv1.2 / TLSv1.3	identical
alpine base	3.24.1	3.24.1 — identical, no musl change
native *.node modules in /app/node_modules	0	0
/usr/bin/wget	→ /bin/busybox	→ /bin/busybox
PID 1	/sbin/tini -- node build/src/index.js	same
/healthcheck	200	200
/readiness	200	200
POST / {__typename}	{"data":{"__typename":"Query"}}	identical
SIGTERM	Shutting down (SIGTERM)…, exit 0	identical
image size	1.42 GB	1.44 GB

So, concretely, and please do not lose these when you act on this review:

• The base digest is real. skopeo inspect --raw docker://docker.io/library/node@sha256:aadf416b…
  resolves to a genuine multi-arch OCI index (linux/amd64 + linux/arm64/v8),
  org.opencontainers.image.version=26-alpine, base.name=alpine:3.24, created 2026-08-05.
• #189's guarantees survive. tini is still PID 1, SIGTERM still reaches node, so #188's
  graceful drain still runs and still exits 0. BusyBox wget still exists, and the exact
  HEALTHCHECK command (wget -qO- "http://127.0.0.1:${PORT:-8080}/healthcheck") exits 0 inside
  the container.
• No native-dependency risk. The whole installed tree contains zero *.node binaries, so
  the musl/alpine question is moot (and alpine is 3.24.1 on both sides anyway).
• No TLS/OpenSSL change. Both images ship OpenSSL 3.5.7 with identical TLS defaults, so the
  Postgres connection and any outbound TLS behave the same. This closes the usual "Node major broke
  our DB TLS" worry.
• The two hand-added lines are benign (see §4).

2. The blocking problem: Node 26 is a Current release, and it is the runtime nothing tests

Node 26 is not LTS today. From the authoritative source
(https://raw.githubusercontent.com/nodejs/Release/main/schedule.json, fetched 2026-09-02):

v22 { lts: 2024-10-29, maintenance: 2025-10-21, end: 2027-04-30 }   <- Maintenance LTS (today)
v24 { lts: 2025-10-28, maintenance: 2026-10-20, end: 2028-04-30 }   <- Active LTS (today)
v26 { start: 2026-05-05, lts: 2026-10-28, ..., end: 2029-04-30 }    <- CURRENT until 2026-10-28

Today is 2026-09-02. Node 26 becomes LTS in 8 weeks. Until then it is the Current line, and
Node's release policy is that semver-major changes land in Current lines. 26-alpine floats:
the next routine Dependabot digest refresh can pull a 26.x that carries a breaking change straight
into the production image. That is a different risk class from a maintenance-LTS digest refresh.

And nothing in CI would see it. Every Node version pinned in this repo, with what this PR does
to each:

file:line	pinned	this PR
Dockerfile:4	node:22-alpine@sha256:16e22a55…	→ 26
Dockerfile:13	node:22-alpine@sha256:16e22a55…	→ 26
package.json:54	"node": ">=22.12.0"	unchanged
.github/workflows/run-tests.yaml:30	'22'	unchanged
.github/workflows/unit-tests.yaml:20	'22'	unchanged
.github/workflows/live-integration.yaml:28	'22'	unchanged
.github/workflows/smoke-load-test.yaml:55	'22.12.0'	unchanged
.github/workflows/lint.yaml:10	NODE_VERSION: 22	unchanged
.github/workflows/publish-npm.yml:33	'22'	unchanged
.github/workflows/security.yaml:27	'20' (EOL 2026-04-30)	unchanged
.github/workflows/nightly-devnet-dump.yaml:56	'20' (EOL 2026-04-30)	unchanged
docs/getting-started.md:20,53	"Node.js 20+"	unchanged
docs/versioning.md:146	"The supported Node.js runtime moves to Node 22."	unchanged

build.yaml builds and pushes the image (build.yaml:159-166) but never runs it — there is
no step that starts the container or hits an endpoint. So after this merges:

the lightnet integration suite, the unit suite, the o1js-based tests and the smoke load test all
run on Node 22; the artifact that reaches production runs Node 26; and no job anywhere executes
Node 26. A Node-26-specific regression in undici (6.27.0 → 8.9.0, a major, and it backs
fetch for graphql-yoga / @graphql-tools/executor-http) or V8 (12.4 → 14.6) is invisible to
every green check on this PR.

My smoke test above covers boot, /healthcheck, /readiness and { __typename }. It does not
cover the event/action resolvers against a real archive DB — which is exactly what
run-tests.yaml covers, on Node 22.

3. This PR contradicts the versioning policy merged in #198

docs/versioning.md:39-40, under Operational contract (the list of breaking changes):

• Raising the minimum supported Node.js runtime, whether through engines, the
  Docker base image, or the Node version used by CI to publish the package.

and docs/versioning.md:146, in the 1.0.0 migration notes operators are told to read:

• The supported Node.js runtime moves to Node 22.

Merging this makes that line false for the shipped artifact on the day 1.0.0 is cut. Note also the
PR title says "20-alpine" while the diff is 22→26 — Dependabot opened this against an older main,
before #194 landed Node 22. The commit message that would enter the release history
(Bumps node from 20-alpine to 26-alpine) is wrong in a repo whose policy treats this as a
breaking change.

4. Cleared: the two non-Dependabot lines someone added to the branch

git log --format='%an / %cn' on f724846: authored by dependabot[bot], committed by
dkijania <dariusz@o1labs.org> on 2026-08-27 — the branch was rebased onto 3fd3379 and amended
by hand. Both added lines are fine, keep them:

• ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 (build stage only). Real: artillery is a
  devDependency (package.json:64) and pulls @playwright/browser-chromium@1.48.1, whose
  install: node install.js fires during npm ci. It does not break the benchmarks:
  benchmark/*.yaml uses no engine: key (HTTP only), and benchmark/ is never COPYd into the
  image, so npm run benchmark was never runnable inside the container anyway. The browser cache
  lands in the build stage's $HOME, not in a shipped layer — both images are ~1.4 GB, so this is a
  build-time saving, not an image-size one.
• npm ci --no-audit --no-fund. Does not weaken #192's gate. That gate is a separate job:
  security.yaml:28 runs npm ci --ignore-scripts, then security.yaml:31 runs
  npm audit --omit=dev --audit-level=critical. --no-audit only suppresses npm's inline
  post-install summary in the image build. Confirmed empirically: the npm audit check is green
  on this PR head.

5. Downstream impact: none

No schema, error-string, status-code or CORS change. POST / {"query":"{ __typename }"} returns
byte-identical output on both images, and the OpenSSL/TLS table above rules out a transport-level
surprise. Neither mina-explorer nor mina-explorer-api is affected by this diff.

---

Required fix

Pick A (recommended — smallest change, zero delay to 1.0.0) or B.

A. Retarget to the current Node 22 LTS digest and close the 26 bump

This still delivers the security value Dependabot opened the PR for — main's pinned digest
16e22a55… was built 2026-06-23, ~10 weeks stale, while the current 22-alpine was built
2026-07-29 — without shipping an untested major.

Dockerfile:4 and Dockerfile:13 — use this exact digest (current node:22-alpine index digest,
verified 2026-09-02; skopeo inspect --raw of it resolves to 5 architectures, base.name=alpine:3.24):

FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS build

FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32

Keep both hand-added lines (ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1, --no-audit --no-fund).

Then stop the recurrence at the source — .github/dependabot.yml, docker ecosystem block:

  - package-ecosystem: docker
    directory: '/'
    schedule:
      interval: weekly
    open-pull-requests-limit: 2
    # Digest/patch refreshes stay automatic (that is the security value). Moving
    # Node majors is a policy decision under docs/versioning.md:39-40, so it is
    # made deliberately, together with the CI matrix and the docs.
    ignore:
      - dependency-name: 'node'
        update-types: ['version-update:semver-major']

B. If a newer Node really is wanted before 1.0.0 — go to 24 (Active LTS), not 26, and land it whole

Node 24 is Active LTS today and supported to 2028-04-30; Node 26 is Current for another 8 weeks.
Current node:24-alpine index digest, verified 2026-09-02:
sha256:e67514e5d0f6c46656005e1b693b2ec9d52e80b641307de684d4a015ba7a4eaf.

In the same PR:

1. Dockerfile:4,13 → node:24-alpine@sha256:e67514e5d0f6c46656005e1b693b2ec9d52e80b641307de684d4a015ba7a4eaf
2. Make CI actually run the shipped runtime. In .github/workflows/run-tests.yaml and
   unit-tests.yaml, matrix the runtime so both the engines floor and the image major are tested:

       strategy:
         matrix:
           node-version: ['22', '24']
       steps:
         - uses: actions/setup-node@v4
           with:
             node-version: ${{ matrix.node-version }}

   and move smoke-load-test.yaml:55, live-integration.yaml:28, lint.yaml:10,
   publish-npm.yml:33 to 24.
3. Leave package.json:54 "node": ">=22.12.0" alone unless you intend to break npm consumers on
   Node 22 — raising it is itself a breaking change under docs/versioning.md:39-40.
4. Fix the docs the change invalidates: docs/versioning.md:146 and
   docs/getting-started.md:20,53 (the latter still says "Node.js 20+" and is already wrong on
   main).
5. Retitle the PR — "20-alpine" is wrong; the base is 22.

---

Acceptance criteria

Self-check all of these before re-requesting review.

1. Both stages agree and the tag is an LTS line. grep -n "^FROM node:" Dockerfile prints two
   lines with the same <tag>@<digest>. For that major M, this prints LTS OK:

   M=22   # the major in the FROM line
   curl -sS https://raw.githubusercontent.com/nodejs/Release/main/schedule.json \
     | python3 -c "import json,sys,datetime as dt;M='$M';d=json.load(sys.stdin)['v'+M];t=dt.date.today().isoformat();print('LTS OK' if d.get('lts','9999')<=t<d['end'] else 'NOT LTS: '+json.dumps(d))"

   (Node 26 fails this today — its lts date is 2026-10-28.)
2. The digest is real and matches the tag.
   skopeo inspect --raw docker://docker.io/library/node@<digest> exits 0, and each linux/*
   manifest carries org.opencontainers.image.version equal to the tag in the FROM line.
3. Tested runtime ⊇ shipped runtime. grep -rn "node-version\|NODE_VERSION" .github/workflows/
   shows the image's Node major appearing in at least run-tests.yaml and unit-tests.yaml, and no
   workflow pins a Node major that is past its end date (this currently fails for
   security.yaml:27 and nightly-devnet-dump.yaml:56, both on Node 20, EOL 2026-04-30).
4. Docs name the same major as the image. docs/versioning.md:146 and
   docs/getting-started.md:20,53 state the Node major that Dockerfile:4 pins. Verify with
   grep -rn "Node.js [0-9]\|Node [0-9]" docs/.
5. engines is not raised unless the PR body explicitly says npm consumers below the new floor
   are being dropped: grep -n '"node"' package.json still shows >=22.12.0, or the PR states the
   break.
6. The image still passes the #189 contract. Build it, then, with a Postgres carrying the 14
   USED_TABLES:
   • docker run -d -e PG_CONN=… -p 8080:8080 <img>; curl -sf localhost:8080/healthcheck → 200
     and curl -sf localhost:8080/readiness → 200;
   • docker exec <c> ps -o pid,args shows 1 /sbin/tini -- node build/src/index.js;
   • docker exec <c> sh -c 'wget -qO- "http://127.0.0.1:${PORT:-8080}/healthcheck"' exits 0;
   • docker kill --signal TERM <c>; logs contain Shutting down (SIGTERM) and
     docker inspect -f '{{.State.ExitCode}}' <c> is 0.
7. If you took option A, .github/dependabot.yml contains the ignore block for
   dependency-name: 'node' / version-update:semver-major, and this PR is closed rather than
   merged.

[dkijania]

Closing as superseded.

This proposed Node 26, which is still a Current release until 2026-10-28. @SanabriaRusso's review here established the rule the repo now follows: the image tracks an LTS line, because a Current line takes semver-major changes that a routine digest refresh would carry straight into production.

Since then #239 merged a bump to Node 25, which turns out to be end-of-life (never LTS; end: 2026-06-01). #235 supersedes both: it moves to Node 24, Active LTS until 2028-04-30, makes CI actually run the shipped runtime via a ['22','24'] matrix, fixes two workflows that were still on EOL Node 20, and adds a dependabot.yml rule ignoring Node semver-major bumps so this class of PR stops being opened.

The two hand-added lines from this branch that the review cleared — PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 and npm ci --no-audit --no-fund — were carried into #235, so nothing from here is lost.

🤖 Generated with Claude Code

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.