[LEnc95]

The production runtime Dockerfile pins Node 22.16.0, which predates the fix for CVE-2026-111497 (Node2Shell). Update its build, production-dependency and runtime stages to 22.23.4, the patched release on the same Node major, and replace the image digest with the verified multi-platform index digest.

The Node.js 22.23.4 release notes document the Brotli decoder fix. Updating all three stages avoids mixing the runtime with dependencies built under the old base.

Validation on Node 22.23.4:

• Pulled and ran the exact bookworm-slim image by its new digest; it reports v22.23.4 and the block-switch error constant added with the fix.
• Frozen pnpm install, pnpm check-types, and compilation with the Docker runtime tsconfig passed.
• Full runtime suite: 34 files / 499 tests passed with four workers. An earlier default-parallel run timed out in one existing test; the complete rerun passed without source changes.
• Python agent suite: 853 tests passed, with existing deprecation warnings.
• Railway graph evaluation passed with no diagnostics. No deployment was performed.

The complete application Docker image was not built; the replacement base image and application compilation were verified. Existing deployments need a rebuild/redeploy. An affected runtime version alone does not establish that a deployed app exposes the Brotli decoder to attacker-controlled input.

[LEnc95]

One separate question while reviewing the deployment setup: has the Railway-hosted OpenTag deployment completed credential rotation following the October 21 Railway security incident?

Railway recommends revoking and replacing sensitive credentials stored before October 21: https://blog.railway.com/p/preliminary-report-october-security-incident

I couldn't verify that from the public repository, and I recognize rotations may happen entirely outside GitHub. If this deployment was in scope, could you confirm whether the old credentials were revoked at their providers, replacements were deployed across both services, and usage/audit logs were reviewed? A brief confirmation or approximate completion date would be helpful; please don't share any secret values or sensitive logs here.

This is separate from the Node2Shell runtime update in this PR, and I'm not suggesting that OpenTag was necessarily affected.