Dockerfile builder stage pins node:23.11.1 — a non-LTS line, EOL since 2025-06-01

Aperta Adatta ai principianti
  • Qualcosa non va?
#223 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

@akshat-kumar-singhal ci sta già lavorando.

Dal 9/8/2026.

  • #224 di @akshat-kumar-singhal — aperta

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
74/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
docker, nodejs
Ambito
build-system, devops

Direzione di ricerca

Inizia dallo stage builder in Dockerfile e rivedi il pin attuale dell’immagine Node e il suffisso Alpine. Esegui la build completa dell’immagine, incluso next build, dopo aver installato le dipendenze; verifica se sharp@^0.32.6 funziona sulla linea Node supportata selezionata. Il lavoro è completato quando l’immagine di produzione viene compilata correttamente con una base Node supportata e senza deriva delle dipendenze.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

The builder stage of this repo's Dockerfile pins a Node line that has been out of support for over a year:

# ---------- builder ----------
FROM node:23.11.1-alpine3.21 AS builder

Verified against nodejs/Release's schedule.json:

line start lts maintenance end of life
v23 2024-10-16 never 2025-04-01 2025-06-01
v22 Jod 2024-04-23 2024-10-29 2025-10-21 2027-04-30
v24 Krypton 2025-05-06 2025-10-28 2026-10-20 2028-04-30

v23 is an odd-numbered line — it was never LTS, and it went EOL on 2025-06-01. It receives no security patches, including for the bundled OpenSSL and undici.

Why this matters more than it looks

This is not a peripheral image. gofr-dev/gofr's docs/Dockerfile does:

FROM ghcr.io/gofr-dev/website:${WEBSITE_TAG} AS builder
...
RUN npm install
RUN npm run build

So this builder stage is the runtime that actually performs next build for production gofr.dev, on both the prod and stage deploy paths.

For context, gofr-dev/gofr#3870 flagged that those deploy workflows ran setup-node on Node 18 (EOL 2025-04-30), fixed in gofr-dev/gofr#3871. But setup-node there governs only the runner-side yarn install / yarn refresh-data steps — it cannot reach this pin. The build itself is on v23, which is staler than the Node 18 that issue was about, and the fix has to land here.

Suggested fix
FROM node:24-alpine AS builder

24.x is the current Active LTS (EOL 2028-04-30). 22.x also works and is supported, but has been in maintenance since 2025-10-21, so it buys ~12 months less.

Verification already done

yarn install --frozen-lockfile was run against this repo's current package.json + yarn.lock in a throwaway node:24-alpine container — Node v24.19.0, Yarn 1.22.22:

  • exit 0
  • lockfile satisfied, no resolution drift
  • no new warnings beyond the pre-existing unmet-peer-dependency set (@algolia/autocomplete-*, autoprefixer/postcss, ts-api-utils)

So the dependency install is known-good on 24. What is not yet verified is the full next build (Next.js 13.4.16) plus sharp@^0.32.6 on Node 24 — sharp ships native binaries and is the most likely thing to need a bump alongside this. Worth building the image locally before merging.

Note the alpine3.21 suffix can simply be dropped, letting the tag track the current Alpine base for that Node line, unless it was pinned deliberately.

Lingua principale
JavaScript
Stelle
44
Fork
44
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di gofr-dev/website

Tutte le issue di gofr-dev/website

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.