mirror of
https://github.com/vectorize-io/hindsight.git
synced 2026-09-14 19:31:49 +08:00
Nicolò Boschi
c57331a942
Node 20 reached end-of-life on 2026-04-30 (nodejs/Release schedule.json), so the builder stages, the cp-only runtime, and the NodeSource package installed into the standalone runtime have all been unpatched for four months. This buys nothing measurable today - a Trivy 0.74.0 HIGH/CRITICAL scan of the standalone image is byte-identical before and after (3 Critical / 82 High, all Debian base packages), because NodeSource ships the latest 20.x patch and it carries no open CVEs. The point is forward-looking: the next Node CVE gets a fix on 24 and never gets one on 20. Node 24 is the current Active LTS (maintenance 2026-10-20, end 2028-04-30) and clears next@16.2.11's `engines: >=20.9.0`. The NodeSource bootstrap moves to setup_24.x in the same commit so the Next standalone bundle is not built on 24 and then executed on 20. Its `[ -e /usr/lib/node_modules/npm ]` guard - which deliberately fails the build if a base bump relocates that path - still holds on 24, and npm is absent from the built image. Also add `**/.next-*` to .dockerignore. The existing `**/.next` does not match the `.next-<port>` scratch directories the control-plane dev server leaves behind, so those got copied into the build context and failed `next build` with type errors against routes deleted long ago. CI never hit this because it checks out clean; every local image build did.
34 lines
322 B
Plaintext
34 lines
322 B
Plaintext
# Node modules (platform-specific native bindings)
|
|
**/node_modules
|
|
**/.next
|
|
|
|
# Python
|
|
**/__pycache__
|
|
**/*.pyc
|
|
**/.venv
|
|
**/dist
|
|
**/*.egg-info
|
|
|
|
# Git
|
|
.git
|
|
.gitignore
|
|
|
|
# IDE
|
|
.idea
|
|
.vscode
|
|
*.swp
|
|
|
|
# OS
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Build artifacts
|
|
**/target
|
|
**/*.log
|
|
|
|
# Test/Dev
|
|
**/coverage
|
|
**/.pytest_cache
|
|
**/.mypy_cache
|
|
**/.next-*
|