From 41f23fe55d8219060b085947406c23d0c69e9b14 Mon Sep 17 00:00:00 2001
From: Michal Pemcak <m.pemcak@gmail.com>
Date: Thu, 22 Oct 2026 08:59:37 +0200
Subject: [PATCH] build: move Docker base image to Node 22

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index af85d59..3702a88 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # Multi-stage: esbuild produces a single Node file (deps inlined) + minified UI.
 # Final image has no node_modules — only dist/ + runtime Node.
 
-FROM node:20-alpine AS build
+FROM node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914 AS build
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci
@@ -10,7 +10,7 @@ COPY ui/ ./ui/
 COPY scripts/ ./scripts/
 RUN npm run build
 
-FROM node:20-alpine
+FROM node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914
 WORKDIR /app
 ENV NODE_ENV=production
 # Runtime is only the bundled server + UI (no node_modules, no source, no mcp-only entry)