fix(docker): bump node base to 24.18.0 (all 24.17.0 CVE fixes + http.Agent premature-close fix)

[charlesBochet]

Context

Follow-up to #22673, which pinned the base image back to node:24.16.0-alpine to stop the prod flood of Invalid response body while trying to fetch …: Premature close failures on Gmail/Calendar sync and Cloudflare checks introduced by the 24.17.0 bump (#22529).

The regression is confirmed upstream: 24.17.0's response-queue-poisoning fix (CVE-2026-48931) attaches a public 'data' listener on idle keep-alive sockets in the http.Agent pool, which false-triggers node-fetch@2's premature-close detection whenever a server abruptly resets a keep-alive socket right after a complete response — standard behavior for Google's front end. Reported the day 24.17.0 shipped (nodejs/node#63989, #64098) and fixed by nodejs/node#64004, released in Node 24.18.0 (2026-06-23).

What this PR does

Bumps all four stages to node:24.18.0-alpine3.23 (digest-pinned). 24.18.0 is the current 24 LTS and contains:

• everything from 24.17.0: OpenSSL 3.5.7, CVE-2026-48930 (CVSS 9.8), and the response-queue-poisoning guard itself — reimplemented via the socket's internal onread hook instead of a public stream listener (http: avoid stream listeners on idle agent sockets nodejs/node#64004)
• so we get the full security posture back and the regression fix.

Verification

Deterministic repro (complete chunked response over keep-alive, then abrupt socket destroy — per nodejs/node#64098), run against all three images with node-fetch v2 and v3:

Node	node-fetch@2	node-fetch@3
24.16.0	OK	OK
24.17.0	ERR_STREAM_PREMATURE_CLOSE: Invalid response body … Premature close (byte-for-byte the prod Sentry error)	OK
24.18.0	OK	OK

node-fetch@2 is what the Gmail batch layer (@jrmdayn/googleapis-batcher) and the Cloudflare client resolve to, matching the affected prod paths.

Related

• fix(docker): pin node base back to 24.16.0 to stop premature-close fetch failures #22673 — interim rollback to 24.16.0 (shipped as twenty/v2.19.1); this PR supersedes it
• fix(sync): treat premature close fetch errors as temporary network errors #22671 — classifies ERR_STREAM_PREMATURE_CLOSE as a transient retryable network error; still worth landing since servers legitimately reset keep-alive sockets

[twenty-ci-bot-public]

🚀 Preview Environment Ready!

Your preview environment is available at: https://slip-jail-basketball-shakira.trycloudflare.com

This environment will automatically shut down after 5 hours.

[Copilot]

Pull request overview

This PR updates the runtime base image for Twenty’s Docker build to Node.js 24.18.0 (Alpine 3.23), restoring the 24.17.0 security posture while also avoiding the http.Agent keep-alive regression that caused ERR_STREAM_PREMATURE_CLOSE failures in production.

Changes:

• Bump all multi-stage Docker build stages from node:24.16.0-alpine3.23 to node:24.18.0-alpine3.23 (digest-pinned).
• Update the in-file rationale comment to reflect that 24.18.0 includes the 24.17.0 security fixes plus the upstream keep-alive regression fix.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/twenty-docker/twenty/Dockerfile">

<violation number="1" location="packages/twenty-docker/twenty/Dockerfile:140">
P3: The comment references `node:24.18.0-alpine` but the actual pinned base image is `node:24.18.0-alpine3.23`. This minor mismatch could cause confusion for future maintainers trying to verify the pinned image matches what the comment describes. Consider updating to `node:24.18.0-alpine3.23` here for accuracy.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P3: The comment references node:24.18.0-alpine but the actual pinned base image is node:24.18.0-alpine3.23. This minor mismatch could cause confusion for future maintainers trying to verify the pinned image matches what the comment describes. Consider updating to node:24.18.0-alpine3.23 here for accuracy.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/twenty-docker/twenty/Dockerfile, line 140:

<comment>The comment references `node:24.18.0-alpine` but the actual pinned base image is `node:24.18.0-alpine3.23`. This minor mismatch could cause confusion for future maintainers trying to verify the pinned image matches what the comment describes. Consider updating to `node:24.18.0-alpine3.23` here for accuracy.</comment>

<file context>
@@ -137,13 +137,12 @@ LABEL org.opencontainers.image.description="Twenty server image (no frontend)."
-# so the scanner will re-flag CVE-2026-48930 (TLS embedded-nul hostname authority
-# rebinding, CVSS 9.8) on the node binary until we re-bump. Re-bump to the next
-# 24.x once the premature-close regression is fixed upstream (nodejs/node).
+# The pinned node:24.18.0-alpine base carries every 24.17.0 security fix
+# (OpenSSL 3.5.7, CVE-2026-48930) plus the fix for the http.Agent keep-alive
+# regression (nodejs/node#64004) that flooded prod with false "Premature close"
</file context>

Suggested change

	# The pinned node:24.18.0-alpine base carries every 24.17.0 security fix
	# The pinned node:24.18.0-alpine3.23 base carries every 24.17.0 security fix