[philippgerard]

What is this PR about?

Updates Dokploy's Node.js runtime from 24.4.0 to 24.22.1 to consume the October 21 Node security release. All four production Dockerfiles, CI pins, development tooling, contributor instructions, and workspace Node engine requirements now agree on the patched version.

Production images explicitly use node:24.22.1-bookworm-slim, preserving their Debian Bookworm base. The devcontainer moves from Bullseye to Bookworm because the new Node release has no Bullseye image. pnpm remains 10.22.0; application dependencies, lockfiles, and application logic are unchanged. The remaining @types/node ranges select TypeScript declarations, not the runtime.

This consumes a public upstream fix; it does not claim a demonstrated Dokploy-specific exploit.

Validation

Local Linux containers: native arm64 and emulated amd64.

• Built the main Dockerfile for both amd64 and arm64; built Dockerfile.cloud, Dockerfile.server, and Dockerfile.schedule for amd64; built the devcontainer for arm64.
• Frozen installs and native-module compilation succeeded with Node 24.22.1 and pnpm 10.22.0. pnpm typecheck passed.
• pnpm --dir apps/dokploy exec vitest run --config __test__/vitest.config.ts --maxWorkers=2: 134 files passed; 1,302 tests passed, 1 existing test skipped. Docker-dependent tests used an isolated Docker Swarm with the configured Nixpacks and Railpack versions.
• Main image: all 198 migrations applied to fresh PostgreSQL 16; restart against the migrated database succeeded. Verified database health, signup/signin, authenticated project reads, authenticated WebSocket container logs, and unauthenticated WebSocket rejection. Repeated the application checks on amd64.
• Both main architectures passed bcrypt, PTY, SSH handshake, Sharp, canonical DNS/HTTPS, Brotli/gzip response, repeated-request, TLS hostname-mismatch, and NUL-containing DNS-name rejection checks.
• Cloud image: all 198 migrations and database-backed health passed. API and schedules images: startup, health, and API-key rejection passed; schedules initialized against disposable PostgreSQL and Redis.
• git diff --check passed. Independent read-only review found no actionable bypass or regression in this diff.

Next builds logged database-resolution warnings with no build-time PostgreSQL; the actual runtime startup checks completed without migration or initialization errors. External Inngest/SMTP/OAuth integrations and the complete VS Code devcontainer feature setup were not exercised.

Checklist

• Created a dedicated branch based on canary.
• Read CONTRIBUTING.md.
• Tested this PR in local instances.

Issues related

Closes #5727

Confidence Score: 5/5

The PR appears safe to merge; no actionable regression was found.

Summary

Updates Node.js from 24.4.0 to 24.22.1 across production images, CI, development tooling, contributor instructions, and workspace engine requirements.

• Dokploy’s production, development, and CI paths use Node.js 24.22.1.

_{Reviews (1) · Last reviewed commit: "build: update Node.js to 24.22.1 securit..." · Reviewed by Greptile}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T20:44:24.522703Z	19786cd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[imrja8]

Thanks a lot for this, @philippgerard, and for the really thorough testing! Runtime security updates are shipped from the Dokploy team, so we've opened #5738 with the same Node.js 24.22.1 bump and are closing this one in favor of it. Really appreciate you flagging it so quickly.