Node.js security release pending: 22.23.4 #1575

A pinned base image or a published openab image is behind the latest Node.js security release for its line, or is on the wrong Node major. The node-security-check workflow keeps this issue up to date daily and closes it once every pin and published image is current.

Pinned base images (Dockerfile.unified)

Published images (ghcr.io/openabdev/openab, linux/amd64)

Next steps

1. For each stale pin, bump ARG NODE<major>_VERSION to the latest security release in every Dockerfile that declares it (git grep -lE 'ARG NODE[0-9]+_VERSION' -- 'Dockerfile*'). Dockerfile.unified declares every line and each other Dockerfile declares only its own. The smoke tests read the expected versions from the Dockerfiles, so a bump needs no workflow edit.
2. A major mismatch row means the pin or image is on a different Node major than its line. Fix the ARG NODE<major>_VERSION value, or rebuild the image from the correct line, instead of bumping the patch version.
3. Follow the "Base image security release" runbook in RELEASING.md to cut a beta, verify node --version in each beta-<agent> image, and promote to stable.
4. Background and policy: RFC: rebuild agent images for Node.js security releases (Node 22.23.4 / 24.22.1) #1567.

Last checked: 2026-10-29 14:40 UTC