[hyoban]

Summary

Bump Node.js from 24.20.0 / 24.21.0 to 24.22.1, the 24.x release in the October 2026 Node.js security releases.

Relevant fixes for us:

• CVE-2026-111497 (High): Brotli decoder out-of-bounds write → RCE. Reachable from server-side fetches in web (Next.js) and dify-agent-runtime.
• CVE-2026-105483 / CVE-2026-106069 / CVE-2026-106072: TLS certificate hostname verification bypasses.
• CVE-2026-105482, CVE-2026-105481: dns.resolve NUL truncation, keep-alive response desync.
• Bundled undici, OpenSSL, c-ares and CA cert updates.

Changes:

• devEngines runtime and engines.node (^24.22.1) in root, cli, packages/dev-proxy, packages/image-resources; devEngines in sdks/nodejs-client (its >=18 engines range is unchanged).
• web/Dockerfile (node:24.22.1-alpine), api/Dockerfile (NodeSource 24.22.1-1nodesource1), dify-agent-runtime/docker/Dockerfile, .devcontainer/devcontainer.json.
• pnpm-lock.yaml regenerated; only the Node runtime entries changed.

Verified that the nodejs.org binaries, Docker Hub node:24.22.1-alpine, and NodeSource 24.22.1-1nodesource1 (amd64/arm64) are all published. Docker images were not built locally.

Checklist

• This change requires a documentation update, included: Dify Document
• I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
• I've verified the change and added or updated tests where meaningful regression risk justifies coverage.
• I've updated the documentation accordingly.
• I ran make lint && make type-check (backend) and vp staged (frontend) to appease the lint gods

Pre-commit vp staged (eslint + vp fmt) passed; backend lint/type-check not run since only the Dockerfile changed on the API side.

From Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.91%. Comparing base (7275495) to head (c84e15f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #44515      +/-   ##
==========================================
- Coverage   88.92%   88.91%   -0.01%     
==========================================
  Files        5572     5572              
  Lines      333940   333940              
  Branches    66834    66834              
==========================================
- Hits       296941   296935       -6     
- Misses      31835    31841       +6     
  Partials     5164     5164              

Flag	Coverage Δ
api	88.99% <ø> (+<0.01%)	⬆️
cli	94.27% <ø> (ø)
dify-ui	91.67% <ø> (ø)
web	88.53% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[hyoban]

Closing as a duplicate of #44511, which makes the same Node.js 24.22.1 bump and was opened first.