Skip to content

docker: Refresh Node.js runtime to 22.23.4 for 3.38.0 - #2898

Merged
Akanksha Jain (jainakanksha-msft) merged 5 commits into
mainfrom
fix/container-node-22-23-4
Nov 9, 2026
Merged

Akanksha Jain (jainakanksha-msft) merged 5 commits into
mainfrom
fix/container-node-22-23-4

Conversation

@jainakanksha-msft

@jainakanksha-msft Akanksha Jain (jainakanksha-msft) commented Nov 9, 2026 •

Copy link
Copy Markdown
Member

Summary

Prepare the container runtime refresh for Azurite 3.38.0. Related to #2872.

  • Pin both Linux Docker stages to node:22.23.4-alpine3.23.
  • Upgrade the Windows Node.js archive, PATH, and working directory from 22.12.0 to 22.23.4.

Why

A newer upstream Node tag does not refresh already-built Azurite images.

Validation

  • npm run build passed.
  • npm run test:package-scripts passed: lint and 9 tests.
  • Workflow YAML parsed successfully; both inline runtime assertions accepted 22.23.4 and rejected 22.23.2 and 22.12.0 in local assertion checks.
  • Verified that the pinned Linux tag provides amd64 and arm64 manifests whose configurations report Node 22.23.4.
  • Verified the Windows 22.23.4 x64 archive is available (HTTP 200).
  • git diff --check passed.

Release notes / limitations

  • Actual container builds, runtime smoke checks, and Docker upgrade compatibility execution remain pending CI: the local Docker daemon is unavailable.
  • This PR does not bump the Azurite application version, republish 3.37.0, or publish 3.38.0 images. The release must build/publish the new images, and consumers must pull and recreate containers.
  • Rebuild container image for 3.37.0 to get critical security patches for Node (v22.23.4) #2872 remains linked rather than automatically closed, since published-image verification is a release-time action.

Prepare Linux and Windows images for the 3.38.0 release with the patched Node.js runtime. Refresh base images on Docker builds and validate the packaged runtime in CI.

Related to #2872.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings November 9, 2026 10:08

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues remain for the container runtime refresh, though container builds, smoke checks, and upgrade validation still await CI.

No open issues 🎉

What changed in this PR

Prepares Azurite’s container runtime refresh for 3.38.0, addressing the Node.js security-update concern in #2872 without changing the application version or publishing images.

Changes:

  • Pins Linux and Windows containers to Node.js 22.23.4.
  • Adds --pull to Docker build scripts and the upgrade-test builder.
  • Adds final-image runtime assertions, a packaging regression test, and an Upcoming Release changelog entry.

Actual container builds, smoke checks, and upgrade compatibility validation remain pending CI. Published-image verification remains a release-time task.

File Description
tests/​upgrade/​utils/​dockerHarness.ts Refreshes base images when building upgrade-test containers.
tests/​packageScripts.test.ts Checks that Docker build scripts include --pull.
package.json Adds --pull to public, internal, and platform-specific builds.
Dockerfile.Windows Updates the Node.js archive, PATH, and working directory to 22.23.4.
Dockerfile Pins both Linux stages to node:22.23.4-alpine3.23.
ChangeLog.md Documents the container runtime security refresh.
.github/​workflows/​PrValidation.yml Asserts Node.js 22.23.4 in final Linux and Windows images.

Review effort: Balanced

Co-authored-by: jainakanksha-msft <181211853+jainakanksha-msft@users.noreply.github.com>
Comment thread tests/packageScripts.test.ts Outdated
}
});

it("refreshes base images for every Docker build script", () => {

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot , let's revert this file change, this is not needed.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Restored the package-script test file in 2d9ed6b.

Comment thread package.json Resolved
Co-authored-by: jainakanksha-msft <181211853+jainakanksha-msft@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Neither Linux nor Windows CI asserts that the final image runs Node 22.23.4, allowing an unexpected patch version to pass validation.

1 open issue

Review effort: Balanced

Comment thread Dockerfile Resolved
Co-authored-by: jainakanksha-msft <181211853+jainakanksha-msft@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Final-image CI does not enforce Node.js 22.23.4 on Linux or Windows, and the upgrade-test builder omits --pull without regression coverage, allowing cached base images to go undetected.

1 open issue

Review effort: Balanced

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The promised forced base-image pulls, exact Node.js 22.23.4 assertions in both container jobs, and refresh regression test are missing.

1 open issue

Review effort: Balanced

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The claimed workflow assertions are missing, so CI can pass without verifying that both Docker images use Node v22.23.4.

No open issues 🎉

1 resolved since last review

Review effort: Max

@jainakanksha-msft
Akanksha Jain (jainakanksha-msft) merged commit 43ebd5b into main Nov 9, 2026
47 checks passed
@jainakanksha-msft
Akanksha Jain (jainakanksha-msft) deleted the fix/container-node-22-23-4 branch November 9, 2026 10:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

featureparity Tracking issues for catching up feature parity v3.38.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Rebuild container image for 3.37.0 to get critical security patches for Node (v22.23.4)

3 participants