[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps the docker-patch-and-minor group in /docker with 2 updates: node and distroless/nodejs24-debian13.

Updates node from d1b3b4d to ebfe2f9

Updates distroless/nodejs24-debian13 from bb6b03d to 9eeb7f5

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[patrickbrandao]

Review of #48: chore(deps): bump the docker-patch-and-minor group in /docker (node, distroless)

Reviewed commit e499ef95c7ce64552f4f0ced3d3793ea48ddfbda (one Dependabot commit on top of 5e2530e) with git diff origin/main...e499ef9. I also read the full docker/Dockerfile at that SHA. origin/main is now 8b5fce2, three commits ahead of the PR base (#55, #56, #65). #55 and #65 change package-lock.json, which feeds the npm ci steps of this Dockerfile.

Summary

The PR changes three FROM lines and nothing else: docker/Dockerfile:10, :37 and :64. Tags and majors are unchanged (node:24-alpine, node:24-slim, gcr.io/distroless/nodejs24-debian13:nonroot). Each new digest is exactly what its tag resolves to today, and each is a multi-arch index that covers linux/amd64 and linux/arm64.

The runtime Node binary does not change. Only the build stages move to Node 24.21.0, which now matches the runtime. There are no blockers and no high-risk criterion applies. There is one should-fix: the hardcoded OCI base-digest label was already stale before this PR and is still stale after it.

Digest verification (docker buildx imagetools inspect, manifests only)

Stage	Tag	Old digest	New digest	New digest == current tag	amd64 / arm64	Node (image ENV NODE_VERSION, amd64 and arm64)
deps / build (:10)	node:24-alpine	d1b3b4da… (2026-04-16)	ebfe2f90… (2026-09-17)	yes	yes / yes (+ s390x)	24.15.0 to 24.21.0
prod-deps (:37)	node:24-slim (bookworm)	24dc26ef… (2026-05-08)	d6aa754f… (2026-10-06)	yes	yes / yes (+ ppc64le)	24.15.0 to 24.21.0
runtime (:64)	distroless/nodejs24-debian13:nonroot	bb6b03d8…	9eeb7f58…	yes	yes / yes (+ s390x, ppc64le)	v24.21.0, unchanged

How I checked the runtime stage:

• Distroless does not expose NODE_VERSION, so I compared the per-platform layer lists.
• On amd64 and on arm64, 21 of 22 layers are byte-identical, including the 44 MB Node layer (2de1d924… arm64, 6dcc9f22… amd64).
• The only differing layer is libssl3t64. I pulled just that ~3.4 MB blob for old and new arm64: openssl 3.5.7-1~deb13u2 becomes 3.5.7-1~deb13u3, a Debian 13 security update.
• docker run --rm --network none <new runtime digest> -p process.version printed v24.21.0, with bundled OpenSSL 3.5.8, on arm64. Node uses its statically bundled OpenSSL, so the system libssl update hardly affects the app process.
• I removed the pulled image afterwards.

So the Node patch change (24.15.0 to 24.21.0) only affects the build stages (npm ci, turbo/nest/vite builds) and prod-deps (npm ci --omit=dev --ignore-scripts). It removes a version skew that existed before: the build ran on 24.15 while the runtime already ran 24.21. Because of --ignore-scripts, no native modules are compiled, so the skew was mostly harmless, but alignment is better. The bundled npm also moves with Node, which can change npm ci behavior. The CI image build passed, and qa-docker should confirm the arm64 build.

CI

gh pr checks 48 is all green: Lint, Unit (backend/cli/frontend/shared), Backend e2e (PostgreSQL 16), Compose smoke test (read-only), install.sh end-to-end, CodeQL and dependency-review.

• The Docker Smoke job built the image from this Dockerfile, but only for linux/amd64 (platforms: linux/amd64).
• The runs date from 2026-10-10 18:06 UTC, against merge base 5e2530e.
• Since then, main gained the fix(deps): patch runtime security alerts #55 runtime lockfile patch and the fix(deps): patch dev-only security alerts in the root lockfile #65 dev lockfile patch, which are exactly the inputs of the npm ci stages that this PR changes.
• git merge-tree against current main is clean, but the image CI built is not the image that would ship.
• Before merge, comment @dependabot rebase so CI rebuilds on current main. Do not push to the branch yourself, because that stops Dependabot from maintaining it.

Runtime and qa-docker

This changes every stage of the shipped image: the build toolchain, the prod-deps install and the runtime libssl. qa-docker is required before merge (ADR 0002). Suggested scope:

1. Build the image locally on the Mac host, which is native linux/arm64, the platform CI does not build.
2. Check that node --version in the runtime is v24.21.0.
3. Run the usual smoke/e2e suite, including a TLS call to a provider mock or a real configured provider, to exercise the runtime TLS path.
4. Check the read-only Compose boot, which CI also covers on amd64.

Findings

Blockers: none.

S1 (should-fix, pre-existing but left stale): org.opencontainers.image.base.digest does not match the runtime base

• Where: docker/Dockerfile:75 declares org.opencontainers.image.base.digest="sha256:b087b405441cd3e8eab9bd53ae3dd1c2b824e7ce13f25c5e9bb353fbdb3f4544".
• That value matches neither the old (bb6b03d8…) nor the new (9eeb7f58…) FROM digest at :64. It has been there since the upstream import, and Dependabot only rewrites FROM lines, so it will drift on every bump.
• Failure scenario: Docker Scout and other supply-chain or CVE tools read this label to identify the base image and recommend base updates. With a wrong digest they attribute the image to a base that is not in it, and they can report or miss vulnerabilities based on the wrong layers.
• Fix: in a follow-up (not on this Dependabot branch), either remove the hardcoded base.name/base.digest labels and let the build add provenance (docker buildx build --provenance/SBOM attestations), or add a CI check that the label equals the FROM digest. The label block also still says Manifest and MNFST, which Docker, Compose e instalador do Thinker #26 rewrites anyway, so tracking it in Docker, Compose e instalador do Thinker #26 is enough.

N1 (nit): node:24-slim index no longer lists s390x. The old index had amd64, arm64, ppc64le and s390x. The new one, as of now, has amd64, arm64 and ppc64le. This is irrelevant for Thinker, which targets amd64 and arm64, and is probably an upstream build still pending. I note it only so nobody is surprised later.

N2 (nit): release notes. The runtime image gets a Debian OpenSSL security update, and the build toolchain moves to Node 24.21.0. Record a line for the v0.1 notes in #31. There is no selectable changeset target other than the legacy package.

The Dependabot warning "Cooldown could not be applied" is informational. .github/dependabot.yml sets no cooldown.

Project and security checks

• No new outbound destination at runtime. The base images come from the same Docker Hub and gcr.io repositories as before, and they are pulled only at build time.
• The runtime still runs as nonroot (UID 65532), with entrypoint /nodejs/bin/node. Both are unchanged in the new runtime config.
• No new manifest/mnfst identifiers. The existing LABEL block and the packages/manifest copy are legacy, covered by Docker, Compose e instalador do Thinker #26 and the stack.
• No auth, crypto-code, migration, workflow, Dependabot-config or governance change. A base-image libssl bump does not change key handling. Merging does not publish anything, since ci: add provisional minimal CI and remove inherited publish workflows #44 removed the publish workflows.

Interaction with the open stack (#51, #52, #57, #60, #66, #70)

• I simulated each merge with git merge-tree --write-tree. chore(deps): Bump the docker-patch-and-minor group in /docker with 2 updates #48 merges cleanly into current main, together with chore(deps): Bump postgres from 16-alpine to 16-alpine in /docker in the docker-compose-patch-and-minor group #47, and against the refactor(frontend): remove the SaaS layer from the dashboard #51 and feat(backend)!: remove phone-home from the backend and the CLI #70 heads.

• In docker/Dockerfile, refactor(frontend): remove the SaaS layer from the dashboard #51 (and so refactor(backend): remove billing, Stripe and plan limits #52, refactor(frontend): remove phone-home and Autofix from the dashboard #57, refactor(backend): remove waitlist, CRM, Gemini Free, free models, GitHub stars and error pages #60 and feat(backend)!: remove Autofix and the Phoenix healer from the backend #66 stacked on it) removes lines 22-30, and feat(backend)!: remove phone-home from the backend and the CLI #70 also removes lines around 89-92. None of them touches the FROM lines 10, 37 and 64.

• Suggested order:

  1. @dependabot rebase.
  2. Get qa-docker green on arm64.
  3. Merge chore(deps): Bump the docker-patch-and-minor group in /docker with 2 updates #48 and chore(deps): Bump postgres from 16-alpine to 16-alpine in /docker in the docker-compose-patch-and-minor group #47 (either order; they touch disjoint files) before the cleanup stack.
  4. Rebase the stack.

  That way the stack's own qa-docker runs validate the base images that will ship. Merging the stack first would also be conflict-free, but it would make those runs validate outdated bases.

Merge note

Under aprovado, S1 must be fixed or tracked in an issue (for example #26), and that issue's link must be recorded in this PR before merge. The other merge gates still apply: CI green on a current base after the rebase, and qa-docker, because this changes the runtime image.

Head revisado: e499ef9
Veredito: aprovado

[patrickbrandao]

Destino dos should-fixes: S1 do #47 na #30; S1 do #48 na #26; as notas de release na #31.