dashmate-helper on v4.1 / v5.0 release lines still builds from node:20-alpine (EOL); backport the helper base-image bump from #5310? #5537

Expected Behavior

The dashmate-helper image shipped with current and upcoming releases runs on a Node.js line that still gets security fixes.

Current Behavior

#5310 (merged via #5307 into v5.1-dev on 2026-10-14) moves the helper image to node:24-alpine. The release lines that operators actually run, or are about to run, still build the helper from node:20-alpine:

ref	helper stage
v4.1.1	Dockerfile#L822: FROM node:20-alpine${ALPINE_VERSION} AS dashmate-helper
v5.0.0-rc.7 (latest pre-release, 2026-10-21)	Dockerfile#L833: same
v6.0-dev	Dockerfile#L831: same
v5.1-dev	Dockerfile#L836: FROM node:24-alpine${ALPINE_VERSION} AS dashmate-helper

As #5310 itself notes, Node 20 reached end of life on 2026-04-30. The Node.js October 21, 2026 security release ships fixes only as v22.23.4, v24.22.1 and v26.12.1. It includes four high-severity CVEs: DNS name truncation on NUL, two TLS hostname-check bypasses, and a Brotli decoder out-of-bounds write. Its dependency updates also include the eMudhra intermediate-CA distrust. The post says that "End-of-Life versions are always affected when a security release occurs". So no 20.x build of these fixes will be published, and the helper images on these lines cannot pick them up by rebuilding.

I have not checked which of these CVEs are reachable through the helper's own code paths. This report is about the base image no longer receiving any fixes, not about a demonstrated exploit.

Possible Solution

Backport only the helper base-image change, node:20-alpine → node:24-alpine, to v5.0-dev before 5.0.0 final. If a 4.1.x patch release is planned, consider it there too. The engines.node bumps in #5310 are marked breaking for npm users of dashmate. The Docker base image is internal to the helper container, so the two changes could likely be separated. If node:24 is too large a jump for a release branch, node:22-alpine (the floor #5310 uses for the other stages) would also be a supported line.

Steps to Reproduce (for bugs)

1. Open Dockerfile at v5.0.0-rc.7 or v4.1.1 and look at the dashmate-helper stage (links above).
2. Compare it with the Node.js release schedule: https://github.com/nodejs/Release/blob/main/schedule.json (v20 end: 2026-04-30).

Context

Operators upgrading to 5.0.0 would otherwise get a new helper image that is already on an unsupported runtime. It would stay unpatched until 5.1.

Your Environment

• Version used: v4.1.1, v5.0.0-rc.7 (source tags)
• Environment name and version: dashpay/dashmate-helper image built from those tags
• Operating System and version: n/a (container)
• Link to your project: n/a

---

This issue was written by Claude, an AI agent operated by the account owner; the observations above come from reading the repository and the Node.js advisories.