[eriktews]

Description

Use node:24-slim instead of node:24.18.1-slim in the Dockerfile to get the most recent updates and security updates.

Fixes # (issue)

This fixes the October 21st security updates for Node: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Keep in mind that you may need to build the container with --pull to make sure you get the latest version.

How Has This Been Tested?

Manual tests on my own server

Checklist:

• I have carefully read CONTRIBUTING.md
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation if applicable
• I have no unrelated changes in the PR.
• I have confirmed that any new dependencies are strictly necessary.
• I have written tests for new code (if applicable)

Please describe to which degree, if any, an LLM was used in creating this pull request.

Fully manual patch

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Changes all four Node stages in docker/Dockerfile from node:24.18.1-slim to node:24-slim.

• Karakeep's Docker stages use the moving Node 24 slim image tag.

_{Reviews (1) · Last reviewed commit: "Use node:24-slim again instead of node:2..." · Reviewed by Greptile}

[pullfrog]

ℹ️ No critical issues — one consistency note below.

Reviewed changes

• Unpins the base image: all four FROM node:24.18.1-slim stages (base, aio_builder, cli, mcp) now use the floating node:24-slim tag, and the four "replace once nodejs/node#65042 is fixed" comments are removed.

The premise checks out. The 24.18.1 pin existed to dodge the Node 24.19 ObjectWrap-cleanup crash (karakeep#2989), and the underlying fixes shipped in v24.22.0 (src: keep global list of addon-provided cleanup hooks, #63985, and src: fix use-after-free in CleanupHookThunkRun, #65630). The #65042 backport named in the removed comments was closed unmerged, but the equivalent fixes landed through those commits, and node:24-slim currently resolves to v24.22.1 (the October 21 security release). So the floating tag carries both the crash fix and the security patches.

ℹ️ CI now runs an older Node than the image

tooling/github/setup/action.yml:10 still pins node-version: 24.18.1, which every test workflow (ci.yml, cli.yml, mcp.yml, sdk.yml, ios.yml, android.yml, extension.yml) consumes. This PR makes the container float to 24.22.x while CI stays on 24.18.1, so CI no longer exercises the runtime that ships and itself runs a build that predates the October 21 security release. Since the fix it was protecting against is in 24.22.0, CI could track 24.x too.

Technical details

# CI Node pin diverges from the container runtime

## Affected sites
- `tooling/github/setup/action.yml:10` — `node-version: 24.18.1`
- Consumed by `.github/workflows/ci.yml` (5 jobs), `cli.yml`, `mcp.yml`, `sdk.yml`, `ios.yml`, `android.yml`, `extension.yml`

## Context
The `24.18.1` pin was added alongside the Docker pin for karakeep#2989 (Node 24.19 ObjectWrap cleanup abort). Both were comment-documented as "until the fix ships". This PR lifts the Docker half only, leaving the CI half behind and creating a version skew that did not exist before.

## Required outcome
- CI and the shipped container track the same Node 24.x line, so tests catch regressions that only manifest on newer 24.x patches.

## Suggested approach (optional)
Bump `node-version` to `24.x` in `tooling/github/setup/action.yml`. This is out of the Dockerfile's scope and safe to defer, but worth doing in a follow-up now that the fix is released.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[Project516]

I checked this against the sources.

• The four FROM lines are the only uses of 24.18.1 in docker/Dockerfile. The stale comments about nodejs/node#65042 go away with them. docker/Dockerfile.dev already uses node:24-alpine.
• On Docker Hub, node:24-slim and node:24.22.1-slim point to the same index digest today (sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205, pushed Oct 21). 24.22.0-slim has a different digest, so the floating tag now includes the security release.
• The crash fix is in v24.22.0. The v24 changelog lists abe1b673e9 (keep global list of addon-provided cleanup hooks, #63985) and 5570a84048 (fix use-after-free in CleanupHookThunkRun, #65630). The #65042 backport was closed unmerged, but the same change shipped through the normal release.
• The one place still on 24.18.1 is tooling/github/setup/action.yml (node-version). Every test workflow uses it, so CI runs a Node that predates the Oct 21 release and differs from the image. That is fine as a follow-up.

The change is correct and complete for the Dockerfile.

[MohamedBassem]

Thanks @eriktews!

[MohamedBassem]

I'll cut a 0.34.1 with the fix