fix(docker): pin Node 22.23.4 for the image and CI (Node2Shell)

CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in Node's
bundled Brotli decoder, fixed on 2026-10-21 in 22.23.4. The image used
the floating node:22-bookworm-slim tag, so a cached or stale base could
still carry an older 22.x. Pin the patched version in both stages and in
the PR checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

.gitea/workflows/pr-checks.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: '22.23.4'
           cache: npm
 
       - name: Install

Dockerfile

@@ -15,7 +15,7 @@
 # ---------------------------------------------------------------------------------------
 # Stage 1 — build
 # ---------------------------------------------------------------------------------------
-FROM node:22-bookworm-slim AS build
+FROM node:22.23.4-bookworm-slim AS build
 
 WORKDIR /build
 
@@ -54,7 +54,7 @@ RUN mkdir -p /split \
 # ---------------------------------------------------------------------------------------
 # Stage 2 — runtime
 # ---------------------------------------------------------------------------------------
-FROM node:22-bookworm-slim AS runtime
+FROM node:22.23.4-bookworm-slim AS runtime
 
 WORKDIR /app
 

README.md

@@ -32,7 +32,7 @@ npm run build        # → dist/  (prerendered pages + the Node server entry)
 npm start            # serve the built site
 ```
 
-Node 22 LTS or newer. Nothing else — no database, no game server, no container runtime.
+Node 22.23.4+ (or 24.22.1+); older builds carry the Node2Shell Brotli bug, CVE-2026-111497. Nothing else — no database, no game server, no container runtime.
 
 ## Running it in production