From 448d6b552cc9680ebf08f8109fb71a273c2ed363 Mon Sep 17 00:00:00 2001 From: Akshat Singhal Date: Sun, 9 Aug 2026 11:17:27 +0530 Subject: [PATCH] chore: move the website build off EOL Node onto 24 LTS (#223) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Dockerfile's builder stage pinned node:23.11.1-alpine3.21. v23 is a non-LTS line that went EOL on 2025-06-01, so it receives no security patches — including for the bundled OpenSSL and undici. That stage is what actually runs `next build` for production gofr.dev: gofr-dev/gofr's docs/Dockerfile layers framework docs onto this image and builds there. CI pinned Node 18.x in all three jobs. v18 went EOL 2025-04-30. Bumped alongside so the PR check validates the same runtime that ships rather than one that is both dead and no longer used by the image. Node 24 is the active LTS through 2028-04-30. The builder tracks the major tag instead of an exact patch: this repo has no Renovate or Dependabot, and the previous exact pin is precisely how the base silently outlived its support window. Verified on node:24-alpine (v24.19.0, Yarn 1.22.22): - `yarn install --frozen-lockfile` — exit 0, no resolution drift - `docker build --target builder` and the full image — both green - next build exports 33 static files; nginx stage serves them - sharp@0.32.6 loads its native libvips (vips 8.14.5) - all three prebuild scripts run clean --- .github/workflows/package.yml | 12 ++++++------ Dockerfile | 8 +++++++- 2 files changed, 13 insertions(+), 7 deletions(-) diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml index a20fb5f..7517cff 100644 --- a/.github/workflows/package.yml +++ b/.github/workflows/package.yml @@ -28,10 +28,10 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - name: Use Node.js 18.x + - name: Use Node.js 24.x uses: actions/setup-node@v4 with: - node-version: 18.x + node-version: 24.x - name: Build App run: | @@ -61,10 +61,10 @@ jobs: with: fetch-depth: 0 - - name: Use Node.js 18.x + - name: Use Node.js 24.x uses: actions/setup-node@v4 with: - node-version: 18.x + node-version: 24.x - name: Install dependencies run: yarn install --frozen-lockfile @@ -113,10 +113,10 @@ jobs: with: fetch-depth: 0 - - name: Use Node.js 18.x + - name: Use Node.js 24.x uses: actions/setup-node@v4 with: - node-version: 18.x + node-version: 24.x - name: Install dependencies run: yarn install --frozen-lockfile diff --git a/Dockerfile b/Dockerfile index 2f30452..b86c19b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -32,7 +32,13 @@ # docker run --rm -p 3001:3000 gofr-website:local # ---------- builder ---------- -FROM node:23.11.1-alpine3.21 AS builder +# Node 24 is the active LTS (EOL 2028-04-30). Tracked as the major tag +# rather than an exact patch pin: this repo has no Renovate/Dependabot, +# and the previous exact pin (node:23.11.1-alpine3.21) silently outlived +# its line — v23 was never LTS and went EOL 2025-06-01. A floating major +# picks up patch + Alpine security updates on rebuild and only needs a +# human when the major itself goes EOL. +FROM node:24-alpine AS builder RUN apk add --no-cache libc6-compat