[nicholasjjlim]

Closes #656

🚀 Summary

• Bumps the base image to node:24.21.0-alpine3.23, applies the outstanding Alpine security updates, and deletes the Node parts that no published stage runs.
• All 87 Inspector findings on pr-662-latest (5 critical, 44 high, 29 medium, 9 low) come from the base image. Not one sits under /app, so neither the app nor its pnpm tree contributes.
• This clears 59 of the 87. The 28 that remain all sit on the Node binary, and all are scanner artefacts. See Manual verification.

✏️ Changes

Dockerfile, three edits:

• Base tag (Dockerfile:4): 24.14.0-alpine3.22 to 24.21.0-alpine3.23. Alpine 3.22 caps Node at 24.16.0, which NVD still lists as affected by the one critical Node CVE. Alpine 3.23 holds musl at 1.2.5, the same minor as 3.22, so the prebuilt sharp binaries see no ABI change. Only 3.24 moves musl to 1.2.6.
• apk upgrade --no-cache in base: the image ships libssl3 and libcrypto3 at 3.5.7-r0, and the v3.23 branch already serves the 3.5.8-r0 that 10 findings ask for, 2 of them critical. It runs before the existing wget, so that download uses the current OpenSSL. It trades exact reproducibility for those backports.
• Removals in runtime: the bundled npm and corepack trees, /usr/local/include/node, and their bin symlinks. Nothing calls npm: pnpm is a checksum-verified static binary, and both published stages start through node. The include/node directory holds Node's vendored OpenSSL headers, which 32 findings match. This stays out of base, because build also derives from base and needs the full toolchain.

🧪 Test plan

No automated test covers a Dockerfile, so each done-when item below was checked by hand against the built images.

• A Node 24 Alpine tag on Dockerfile:4: 24.21.0-alpine3.23. This deviates from the tag the issue names. Node is newer and Alpine is one release lower, to hold musl at 1.2.5.
• The scan comes back clean, or its residual is listed with a reason: 28 remain, listed under Manual verification.
• docker build succeeds for every stage: all 6 build (base, build, prod-deps, runtime, migrate, production).
• node --version in the image: v24.21.0.
• pnpm test run, pnpm check, pnpm lint: 651 tests pass; 5692 files with 0 errors and 0 warnings; lint clean.
• The migrate image still runs migrations: Prisma 7.10.0 loads prisma.config.ts and the schema, then fails P1001 against a dead host.
• sharp still works: sharp 0.35.4 on libvips 8.18.6 encoded and re-read an AVIF image on musl 1.2.5. pnpm build also produced 204 image files.

✅ Manual verification

Scan pr-663-latest in ECR after this merges. Query the linux/arm64 child manifest rather than the tag, because the tag is an OCI index and returns UNSUPPORTED_IMAGE. Expect 28 findings: 1 critical, 8 high, 13 medium, 6 low.

Read those 28 as artefacts before you treat them as work. Each sits on the Node binary, and each carries a fixedInVersion that names Node 25 or 26. Per NVD, the Node 24 line fixed them at 24.14.1, 24.17.0 and 24.19.0, all at or below the 24.21.0 this image runs. The baseline shows the same effect: it reports CVE-2026-21637 against 24.14.0, which NVD records as fixed in 24.13.0.

One environment note: a local docker build behind Cloudflare Gateway fails on TLS, because the proxy CA is absent from the container trust store. That predates this change: pnpm db:generate in build already failed the same way.

---

🤖 Generated with dx-create-pr

[ivanfoong]

lgtm