From c0ad7c35a346a861e30a1f4fa00dbaa2c569168d Mon Sep 17 00:00:00 2001
From: inchang-ing <291394088@qq.com>
Date: Sun, 25 Oct 2026 20:43:06 +0800
Subject: [PATCH] fix(docker): bump UI_BUILD_IMAGE to node 24.22.1 (Oct 2026
 security release)

The pinned node:24.19-alpine3.24 base predates the 2026-10-21 Node.js
security releases. The patched minimum on the 24.x line is 24.22.1.

The new digest was cross-verified against the official
node:24.22.1-alpine3.24 manifest (matching the digest quoted by other
projects that already bumped for the same advisory).

The runtime image's Wolfi-provided nodejs is pulled at build time and
needs a base-image rebuild to pick up 26.12.1; this change covers the
UI build stage that the Dockerfile pins explicitly.

Fixes #48299

Signed-off-by: inchang-ing <197932532+inchang-ing@users.noreply.github.com>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 4cef63c8d71..fa4ac493f7a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,7 +7,7 @@ ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:360896efb0753a5701c
 ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:360896efb0753a5701c48f860e17130c205eae5a264797aa3e7ea126ee2923a7
 ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a
 # Pinned by digest like the other base images; bump explicitly on Node upgrades.
-ARG UI_BUILD_IMAGE=node:24.19-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43
+ARG UI_BUILD_IMAGE=node:24.22.1-alpine3.24@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 # Checksum from https://www.pgbouncer.org/downloads/ (the Wolfi repo only carries 1.24.x)
 ARG PGBOUNCER_VERSION=1.26.0
 ARG PGBOUNCER_SHA256=afd25dd61ee6775d37b40629b87ce08736b3e6955f3057bb212e410fbf21c71d