Skip to content

fix: rebuild Fly deployments on updated Node 24 images - #266

Closed
brookslybrand wants to merge 2 commits into
mainfrom
brooks/node-oct-2026-security
Closed

brookslybrand wants to merge 2 commits into
mainfrom
brooks/node-oct-2026-security

Conversation

@brookslybrand

@brookslybrand brookslybrand commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • Keep the production Docker image on the floating node:24-alpine tag, so future Node 24 patches can be picked up.
  • Rebuild without cached layers on staging and production Fly deployments.

The floating image tags currently resolve to the same official image digests as their patched Node 24.22.1 counterparts. This addresses the October 21, 2026 Node.js security release without freezing the runtime on this patch. Future Node releases still require a new deployment; restarting existing machines is not enough. Fly’s --no-cache flag is supported by flyctl and avoids cached Docker build layers.

Validation

Lint, typecheck, 81 Vitest tests, and production build passed on Node 24.22.1.
Official Docker Hub tags and digests verified. Docker is not installed locally, so no container build was run; CI should verify the image build.

Generated by an AI agent on behalf of Brooks Lybrand. Model: shopify/auto; reasoning: medium.

@brookslybrand brookslybrand changed the title fix: use patched Node.js 24.22.1 in production fix: rebuild Fly deployments on updated Node 24 images Oct 22, 2026
@brookslybrand
brookslybrand deleted the brooks/node-oct-2026-security branch October 22, 2026 15:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant