# Q284 / #470 — patched Node worker base

The worker base is Node24.22.2 Bookworm slim, pinned to the official Docker
Library Node multi-platform index digest. The previous mutable Node24 tag
could resolve to, or reuse a cached copy of, an older vulnerable release.

The Node project identifies the October2026 Brotli decoder memory corruption
as CVE-2026-111497, fixed in24.22.1. Version24.22.2 was released on2026-10-28.
Primary release/advisory sources:

- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
- https://nodejs.org/en/blog/release/v24.22.2

`index.json` is the exact official registry response read2026-10-29T03:30:27Z.
Its SHA256 equals the registry Docker-Content-Digest and the Containerfile pin.
The included Linux amd64 manifest is selected by its platform and independently
matches its own digest. `RECEIPT.json` gives both identities plus config/layers.
Only registry metadata was fetched: no layer pull, image build, binary, test,
container, native or privileged operation was performed for this source change.

This does not establish an installed/deployed version, binary provenance beyond
the selected official registry asset, a full-CI result, or a completed #470
image rebuild. The retained #470 runtime measurements name other deployed
api/orchestrator/web images; no binding from those images to this worker was
observed. Each existing deployment still needs its repository's authorized CI,
current runtime readbacks and separate operating approval.

The apt inputs and tag-only production activation receipts remain #714.
The Pi/Undici dependency correction remains #713. This base pin does not replace
either fix or modify any frozen #660/#678/#683 evidence.

Independent-review follow-up: `linux-amd64-config.json` is the exact 6,707-byte
registry config blob selected by the saved manifest. Its SHA256 is
`9564952982df837e05d23c77e319715650fafc77b1abce39a504b920fda46a44`, and its
image environment declares `NODE_VERSION=24.22.2`. `CONFIG-RECEIPT.json` records
the later public metadata read and corrects the earlier receipt's imprecise
"manifest/config reads" wording; the earlier receipt itself is preserved.
This is a declared config/version binding, not execution of `node --version`.

The image-preparation helper now records the one digest-pinned Containerfile
FROM reference directly. A well-formed receipt naming a stale mutable-tag image
refuses before image inspection. The helper does not inspect an unrelated local
base tag. Frozen #660 packets and running H1 inputs are unchanged; this is only
a future source candidate. The dedicated runner must admit and validate the
exact joined candidate before any merge or image use.