Context
Production image currently ships Node 20 (EOL 2026-04-30) while plugins/ already requires >=22:
@openzeppelin/relayer-sdk@1.10.0 declares engines: { node: '>=22.14.0' }
- Image ships
20.19.6 → live engine violation (warning only without engine-strict)
Node 20 receives no further upstream security fixes. Scan flagged CVE-2025-55130 in 20.19.6.
Current pin nodejs=~${NODE_VERSION} with NODE_VERSION=20.19 is a prefix match, frozen to 20.19.x since #266. No automation alerts on it.
Proposal
Migrate to Node 24 (Active LTS, EOL 2028-04-30).
- 22 is maintenance (EOL 2027-04-30) — would need another bump next year
- 26 is not LTS until 2026-10-28
Pin by major so patches flow in on rebuild:
Acceptance criteria
- Dockerfile.production and Dockerfile.development use nodejs-24
- CI uses Node 24
- node --version reports 24.x in built image (amd64/arm64)
- pnpm install no longer warns about unsupported engine for relayer-sdk
- pnpm test in plugins/ + cargo test services::plugins green
- One example plugin runs with PLUGIN_USE_POOL=true and false
Context
Production image currently ships Node 20 (EOL 2026-04-30) while
plugins/already requires >=22:@openzeppelin/relayer-sdk@1.10.0declaresengines: { node: '>=22.14.0' }20.19.6→ live engine violation (warning only withoutengine-strict)Node 20 receives no further upstream security fixes. Scan flagged CVE-2025-55130 in 20.19.6.
Current pin
nodejs=~${NODE_VERSION}withNODE_VERSION=20.19is a prefix match, frozen to20.19.xsince #266. No automation alerts on it.Proposal
Migrate to Node 24 (Active LTS, EOL 2028-04-30).
Pin by major so patches flow in on rebuild:
Acceptance criteria