[peakematt]

Summary

Pins Node to 24.22.3, the 24.x release in the November 2026 Node.js security releases. It fixes High-severity CVEs in http2, tls, http and llhttp (release notes). Customers pull the published images, so the runtime base image is the change that matters.

• Dockerfile: ARG NODE_VERSION=24 → 24.22.3. All three stages use it (FROM node:${NODE_VERSION}-alpine), so they move together. docker buildx imagetools inspect node:24.22.3-alpine lists both linux/amd64 and linux/arm64. The repo doesn't pin digests, so this PR doesn't either. A local build of the postgres image runs node -v → v24.22.3.
• lint.yml and release.yml: setup-node node-version: 24 → 24.22.3.

Not changed:

• The CI test matrix node: [22, 24]. Branch rules require the check names it produces (Engine Node 22, …), and 24 already resolves to the newest 24.x.
• engines: >=22. That is the minimum supported version.

After merge: the GHCR images are only republished when release.yml runs for a release-please release. Customers keep getting the old base image until one ships.

Link to Devin session: https://app.devin.ai/sessions/4943a418e00c4e0882ed6ba7f63fe2da
Open in Devin Desktop: https://app.devin.ai/desktop/session/4943a418e00c4e0882ed6ba7f63fe2da?variant=devin
Requested by: @peakematt

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from Devin Bot

In the workos/sync-engine repository, open a PR to update Node for the November 2026 Node.js security release. Move it to Node 24.22.3 (the patched 24.x release; notes: https://github.com/nodejs/node/releases/tag/v24.22.3).

Context: Node 22.23.5, 24.22.3 and 26.13.1 shipped on Nov 11, 2026, fixing High-severity CVEs in http2, tls, http and llhttp (advisory: https://nodejs.org/en/blog/vulnerability/november-2026-security-releases). This PR is one row in the security team's rollout tracker; Matt Peake (security) asked for it.

• PR title: "Move Node to 24.22.3 for the November 2026 Node security release" (keep any title prefix the repo's conventions require, e.g. "chore:" / "fix:" as last time).
• Last time's PR for this repo, to use as the pattern: None. Update the same kinds of pins (mise/.nvmrc/.node-version, engines, CI node-version, Dockerfile base images and their sha256 digests or checksums, smoke tests asserting the version). Don't rewrite historical docs, evidence or changelog entries other than adding a new one if the repo keeps a changelog.
• Tracker note for this row: Customers pull these public images. Not in INC-769.
• If a Docker base image tag for the new version (Docker Hub node:, dhi.io/node:) is not published yet, check again every ~20 minutes for up to 3 hours. If it is still missing, open the PR with every pin you can change and say in the PR body which image is still pending, or report blocked if nothing can change yet.
• If the repo no longer uses Node, or is already on the patched version, don't open a PR; report n/a with the reason.
• Don't merge or approve anything. Follow the repo's PR template and pre-commit hooks, and get CI green.

Deliverable: the PR URL (or the n/a / blocked reason) in your structured output.