[MantisClone]

Problem

The Request Node Docker image still uses end-of-life Node 18.19.0. The tested 0.38.0 image also accepts the compromised eMudhra certificate chains. This addresses the runtime upgrade requested in private issue 236 and the current security update in REQ-716.

Proposed Solution

Use Node 22.23.4 on Alpine 3.23 for the gateway build and runtime. Pin the base image by its SHA-256 digest and record the source repository and commit in the image labels.

Design Rationale

Node 22 provides the required security fixes and is already used by the SDK. The gateway image is built here, so changing the SDK toolchain alone would not update its deployed runtime. The companion SDK PR updates its build toolchain. Preserve the existing release inputs and version tags.

Considerations

Merge this change before the normal SDK release, targeting client SDK 0.66.0 and gateway 0.52.0. SDK release-tools then builds the image using the exact released gateway package. Verify that build succeeds and validate its published digest in staging before production. Retain the previous deployed image/configuration for rollback. No ongoing 0.38.x maintenance line is planned.

The gateway upgrade includes application and dependency changes, including topic-query pagination and Lit authorization behavior. Validate existing clients against those changes. The local build reports Lit deprecation warnings; test that integration if the gateway uses it. PostgreSQL, IPFS, Graph application and host-package updates are outside this PR.

Validation

• Gateway 0.51.0 builds locally for amd64 and its CLI loads on Node 22.23.4. Its health endpoint returns 200; readiness and writes return 503 before initialization. These checks did not create or read real requests.
• That image rejects all 14 compromised-certificate test chains with CERT_REVOKED and connects successfully to both legitimate HTTPS test sites.
• The complete npm dependency inventory was compared with the old 0.38.0 image. The application and library versions change; the full comparison is available for assessment.
• The workflow file passes a YAML syntax check. We have not run it in GitHub Actions.
• Gateway 0.52.0 still needs its own image and dependency checks, successful amd64/arm64 builds, and the staging tests below. Retest the exact published image.

UAT

1. Save each staging gateway's current Docker image and configuration for rollback. Record several existing requests and their expected contents.
2. Deploy the gateway 0.52.0 image built with Node 22.23.4. Confirm it becomes ready and stays ready.
3. Read the recorded requests using both the currently used client version and SDK 0.66.0. Confirm the data matches. Check request listings, including pagination, for missing or duplicate results.
4. Create a staging test request and wait for confirmation. Read it using a new client instance and confirm its contents.
5. Confirm the gateway can connect to its legitimate HTTPS services and rejects the compromised certificate chains.
6. After staging passes, deploy the same Docker image to production, identified by its SHA-256 digest. Repeat the read and security checks. Create production test requests only if approved.

If checks fail, restore the previous image and configuration. Keep stored data intact. Check whether pending submissions completed before retrying them.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The reviewed changes appear safe to merge; no actionable issues were found.

Summary

Updates Request Node’s build and runtime base to digest-pinned Node 22.23.4 on Alpine 3.23.

• Request Node images now use a digest-pinned Node 22.23.4 base.
• New Request Node images identify their source repository and build commit.

_{Reviews (1) · Last reviewed commit: "fix: run Request Node on patched Node 22" · Reviewed by Greptile}