[Spyros-Vl]

🔒 fix: Bump Node to 22.23.4 / 24.22.1 for October 2026 security release

Node.js published security releases on 2026-10-21 covering, among
others, CVE-2026-111497 (Brotli out-of-bounds write / RCE),
CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069,
CVE-2026-106070, CVE-2026-106072 and CVE-2026-106074, plus bundled
dependency updates for OpenSSL, c-ares, SQLite, undici and the CA
store (eMudhra intermediate CA compromise).

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Sandbox runtime (user code):

• build-packages.sh, docker/package-init.sh: NODE_VERSION default
  24.15.0 -> 24.22.1
• helm/codeapi/values.yaml: packages.nodeVersion 24.15.0 -> 24.22.1
• service/src/config.ts (+ spec): node language version 24.15.0 ->
  24.22.1 so requests resolve to the newly installed runtime

Container images:

• api, worker-sandbox, launcher Dockerfiles: node:22-slim ->
  node:22.23.4-slim (node binary + headers copied into the rootfs)
• service/Dockerfile.node: node:22-slim -> node:22.23.4-slim
• packages/code/Dockerfile: node:24-alpine -> node:24.22.1-alpine
• packages/extraction/Dockerfile: node:24.16.0-bookworm-slim ->
  node:24.22.1-bookworm-slim

CI:

• ci.yml: matrix 22.21.0 / 24.16.0 -> 22.23.4 / 24.22.1
• extraction.yml: 24.16.0 -> 24.22.1

Floating tags are pinned to the patched releases so a cached layer or
stale mirror cannot resolve to a pre-fix image.

These are patch releases within the same majors, so NODE_MODULE_VERSION
is unchanged (127 for 22.x, 137 for 24.x) and native addons such as
anonymous-pipes.node keep loading without a rebuild.

Upgrade note: the sandbox runtime now installs to /pkgs/node/24.22.1.
Existing deployments need package-init to run again (Helm job or
baked image rebuild) before the new version is selectable.

[lia-by-librechat]

Reviewed head 058029f. Restored sessions can retain node_modules links to the previous runtime and lose ESM imports after an image rebuild. Prerequisite #347 fixes that migration; recommend landing it first.

Local qualification passes: 51 worker tests on each patched Node version, 14 extraction tests on Node 24.22.1, 15 service-config tests, Helm runtime selection, all sandbox Dockerfile checks, the Node 22.23.4 native-addon/packaged IPC smoke, and extraction container security/restart checks including 75 adversarial fixtures.

The CI, Images, and Extraction Service runs still require fork-workflow approval. API and service typechecks each have seven baseline diagnostics, confirmed against main.