chore(backend): float Docker base back to node:22 now that 22.23.1 ships the fix

[kaviththiranga]

Node 22.23.1 (nodejs/node#64004) reverts the keep-alive socket-reuse
regression that 22.23.0's CVE-2026-48931 fix introduced, so the temporary
node:22.22 pin is no longer needed. The node-fetch@2 premature-close failure
on internal service-to-service calls (catalog -> permission) no longer
reproduces on 22.23.1+.

Summary by CodeRabbit

• Bug Fixes
  • Updated the backend runtime to use the latest Node 22 image again, which restores newer patched Node versions in builds and deployments.
  • Removed the temporary version pin introduced for a past Node networking issue, now that the problem no longer reproduces on current releases.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates the backend Dockerfile to use floating node:22-bookworm-slim in all stages and revises the changeset to a backend patch bump with updated Node pinning guidance.

Changes

Backend Node 22 unpin

Layer / File(s)	Summary
Dockerfile base image update packages/backend/Dockerfile	All backend Docker stages switch from node:22.22-bookworm-slim to node:22-bookworm-slim, and the runtime-stage comment is rewritten with the updated Node 22.23.1+ note.
Changeset release note update .changeset/unpin-node-22-22.md	The changeset changes the bump to backend: patch and updates the Node pinning guidance text.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• openchoreo/backstage-plugins#649: Flips packages/backend/Dockerfile back to the floating node:22-bookworm-slim, matching the same base-image unpinning path.

Suggested reviewers

• sameerajayasoma
• stefinie123
• Mirage20
• akila-i

Poem

🐰 I hopped from 22.22 to 22,

My carrots are fresh and my builds are too.

A tiny patch, a Dockerfile gleam,

Node floats on by in a softer beam.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is only a short summary and omits most required template sections like Purpose, Goals, Approach, tests, and release note.	Fill in the required template sections, especially Purpose, Goals, Approach, User stories, Release note, Automation tests, Security checks, and related links.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: floating the backend Docker base back to node:22 after the fix in 22.23.1.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/backend/Dockerfile`:
- Around line 55-64: The Dockerfile only documents the Node 22.23.1 minimum, but
`build-image` can still use a cached `node:22-bookworm-slim` below that floor.
Update the backend image flow by adding an explicit runtime version check in
`packages/backend/Dockerfile` around the `FROM node:22-bookworm-slim` stage so
the build fails unless Node is at least 22.23.1, and consider aligning
`build-image` in `packages/backend/package.json` to pull a fresh base image so
the cached image cannot bypass the minimum patch requirement.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8c1e4138-7a19-4c7a-9e57-06516e5b61e9

📥 Commits

Reviewing files that changed from the base of the PR and between 62608f5 and d1a0570.

📒 Files selected for processing (2)

• .changeset/unpin-node-22-22.md
• packages/backend/Dockerfile