build(deps): update Node.js to 24.16.0-alpine#686
Conversation
- Update gateway.Dockerfile (build + runtime stages) from node:24-alpine to node:24.16.0-alpine@sha256:2bdb65ed... - Update workspace.Dockerfile from node:24-alpine to node:24.16.0-alpine @sha256:2bdb65ed... - Fix renovate.json5 comment to accurately describe versioning behavior Renovate cannot auto-upgrade from an imprecise tag (24-alpine, precision 1) to a precise one (24.16.0-alpine, precision 3) — this is a documented limitation. Pinning to the full semver tag lets Renovate maintain future updates (e.g. 24.16.0 → 24.17.0) with correct PR titles and inline Node.js release notes via sourceUrl. Closes #667
fro-bot
left a comment
fro-bot
left a comment
There was a problem hiding this comment.
Verdict: PASS
Clean dependency pin upgrade. All three Dockerfiles consistently use node:24.16.0-alpine@sha256:2bdb65ed... — same digest across build/runtime stages and the workspace image. The renovate.json5 comment update accurately describes how versionCompatibility splits the tag (version vs compatibility suffix), which is more precise than the previous explanation about alias resolution.
The PR description explains the limitation correctly: Renovate cannot auto-upgrade from an imprecise tag (24-alpine) to a precise one (24.16.0-alpine), so this manual pin is the correct bootstrap step.
Blocking issues
None
Non-blocking concerns
None
Missing tests
None — Dockerfile base image bumps don't require test changes.
Risk assessment (LOW/MED/HIGH): LOW
This is a patch-level Node.js version bump (24.x series, LTS-track) pinned to a specific digest. No API surface changes. The digest is consistent across all three FROM statements (build stage, runtime stage, workspace), eliminating any stage mismatch risk.
Run Summary
| Field | Value |
|---|---|
| Event | pull_request |
| Repository | fro-bot/agent |
| Run ID | 26579030503 |
| Cache | hit |
| Session | ses_19121a899ffeC17ndQrTbv61Ns |
2 participants
Renovate cannot auto-upgrade from an imprecise tag (24-alpine, precision 1) to a precise one (24.16.0-alpine, precision 3) — this is a documented limitation. Pinning to the full semver tag lets Renovate maintain future updates (e.g. 24.16.0 → 24.17.0) with correct PR titles and inline Node.js release notes via sourceUrl.
Closes #667