Skip to content

Update Node.js base image: 20,22,24 #118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
johnwatson484 merged 7 commits into from
Feb 20, 2026
Merged

Update Node.js base image: 20,22,24 #118

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
e1528b3
Update Node.js base image: 20,22,24
docker-parent-image-bot[bot] Feb 20, 2026
20d5737
Add exclusions
johnwatson484 Feb 20, 2026
33889fb
Merge branch 'master' into update-node-base-image-202224
johnwatson484 Feb 20, 2026
a53d8c4
Add exclusions
johnwatson484 Feb 20, 2026
7348f58
Add exclusions
johnwatson484 Feb 20, 2026
c4c3ea5
Add exclusions
johnwatson484 Feb 20, 2026
bbbcb58
Add exclusions
johnwatson484 Feb 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .grype.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,21 @@ ignore:
reason: "Node 20: npm patched but not yet available in Node 20 base images"
- vulnerability: GHSA-29xp-372q-xqph
reason: "Node 24: Node-tar patched but not yet available in Node.js base images"
- vulnerability: GHSA-83g3-92jg-28cx
reason: "Node 20: Node-tar patched but not yet available in Node.js base images, issue not exploitable in npm context"
- vulnerability: GHSA-8qq5-rm4j-mr97
reason: "Node 20: Node-tar patched but not yet available in Node.js base images"
- vulnerability: GHSA-r6q2-hw4h-h46w
reason: "Node 20: Node-tar patched but not yet available in Node.js base images"
- vulnerability: GHSA-5j98-mcp5-4vw2
reason: "Node 20: Node-glob patched but not yet available in Node.js base images, issue not exploitable in npm context"
- vulnerability: CVE-2025-60876
reason: "Alpine BusyBox: No fix available"
- vulnerability: GHSA-34x7-hfp2-rc4v
reason: "Node 20,22: Node-tar patched but not yet available in Node.js base images"
- vulnerability: GHSA-7h2j-956f-4vf2
reason: "Node 24: brace-expansion patched but not yet available in Node.js base images"
- vulnerability: GHSA-v6h2-p8h4-qcjw
reason: "Node 20,22: brace-expansion patched but not yet available in Node.js base images"
- vulnerability: GHSA-3ppc-4f35-3m26
reason: "Node 22: minimatch patched but not yet available in Node.js base images"
13 changes: 13 additions & 0 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ CVE-2024-21538

# Node 24: node-tar patched but not yet available in Node.js base images
CVE-2025-64118
CVE-2026-24842
CVE-2026-26960
CVE-2026-23745
CVE-2026-23950

# Node 20: Node-glob patched but not yet available in Node.js base images, issue not exploitable in npm context
CVE-2025-64756
Expand All @@ -15,3 +19,12 @@ CVE-2024-58251

# Alpine: SSL client, no fix available
CVE-2025-46394

# Node 24: brace-expansion patched but not yet available in Node.js base images
CVE-2026-25547

# Node 24: minimatch patched but not yet available in Node.js base images
CVE-2026-26996

# Node 22: jsdiff patched but not yet available in Node.js base images
CVE-2026-24001
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Set default values for build arguments
ARG DEFRA_VERSION=3.0.0
ARG BASE_VERSION=24.12.0-alpine3.23
ARG DEFRA_VERSION=3.0.1
ARG BASE_VERSION=24.13.1-alpine3.23

FROM node:$BASE_VERSION AS production

Expand Down
2 changes: 1 addition & 1 deletion JOB.env
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
DEFRA_VERSION=3.0.0
DEFRA_VERSION=3.0.1
IMAGE_NAME=node
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,9 @@ The following table lists the versions of node available, and the parent Node.js

| Node version | Parent image |
| ------------- | ----------------- |
| 20.19.6 | 20.19.6-alpine3.23 |
| 22.21.1 | 22.21.1-alpine3.23 |
| 24.12.0 | 24.12.0-alpine3.23 |
| 20.20.0 | 20.20.0-alpine3.23 |
| 22.22.0 | 22.22.0-alpine3.23 |
| 24.13.1 | 24.13.1-alpine3.23 |

Two parent images are created for each version:

Expand Down
6 changes: 3 additions & 3 deletions image-matrix.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
[
{"nodeVersion": "20.19.6", "alpineVersion": "3.23", "tags": ["latest-20"]},
{"nodeVersion": "22.21.1", "alpineVersion": "3.23", "tags": ["latest-22"]},
{"nodeVersion": "24.12.0", "alpineVersion": "3.23", "tags": ["latest-24", "latest"]}
{"nodeVersion": "20.20.0", "alpineVersion": "3.23", "tags": ["latest-20"]},
{"nodeVersion": "22.22.0", "alpineVersion": "3.23", "tags": ["latest-22"]},
{"nodeVersion": "24.13.1", "alpineVersion": "3.23", "tags": ["latest-24", "latest"]}
]