[andi-bigswitch]

Change

• Pin the application Dockerfile to the Node 22.23.4 Alpine 3.23 image digest. Node 22.23.4 includes the Brotli decoder fix for CVE-2026-111497.
• The previous digest contains Node 22.22.2. The new digest resolves to Node 22.23.4 on both amd64 and arm64 without changing the Alpine 3.23 base.

Verification

• Built the Docker image and confirmed its runtime reports Node v22.23.4. Brotli compression/decompression round-trip passed; a malformed stream was rejected.
• On Node 22.23.4: 1,013 unit tests passed (12 skipped); 106 integration tests passed. Lockfile, engine, and peer-dependency checks passed.
• git diff --check passed. Dockerfile build completed with two warnings on unchanged ENV and CMD lines.
• ESLint still reports 174 errors and 7 warnings in unchanged JavaScript files; JavaScript Standard Style also fails in unchanged files. The user approved documenting these existing lint failures for a draft PR.

Release follow-up

This pin affects newly built application images. The checked-in Kubernetes manifest and Helm defaults still name older published application image tags. The deployment workflow also selects a Docker Hub image while the current release workflows publish to GHCR. Confirm the release and deployed image digests before treating running instances as remediated.

AI-Assisted-By: Codex (gpt-6-sol)
Fixes: BUG2048954