Update Node.js to e67514e

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
node (source)	final	digest	d32cdf6 → e67514e

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • "after 5pm on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

[claude]

Reviewed per .claude/REVIEW.md — no findings, the bump looks clean.

What actually changed

The one-line diff moves the pinned digest for node:24-alpine in stacks/peerdb-ui.Dockerfile:

	Old (d32cdf6)	New (e67514e)
Node.js	24.19.0	24.20.0 (LTS "Krypton")
Alpine base	alpine:3.24	alpine:3.24 (unchanged)
Tag alias	24-alpine	24-alpine = 24-alpine3.24

Verified via the Docker Hub tag API (the new digest is the current 24-alpine / 24-alpine3.24 manifest list, pushed 2026-08-27) and by reading 24/alpine3.24/Dockerfile in nodejs/docker-node at the relevant commits. Notably no Alpine major-version change — Alpine 3.24 landed for Node 24 back in docker-node#2534 (2026-06-10), well before the previous pin. The manifest list still covers linux/amd64 and linux/arm64.

Release-notes / regression review (Node 24.19.0 → 24.20.0)

v24.20.0 (2026-08-26) is a semver-minor LTS release, not a security release, with no documented breaking changes or deprecations. Every notable change is additive and either opt-in or new API surface:

• async_hooks: using scopes for AsyncLocalStorage
• buffer: new end parameter
• loader: package maps — gated behind --experimental-package-map (nodejs/node#62239), so no effect on the Next.js node_modules resolution used here
• lib,permission: permission.drop; src,permission: --permission-audit (both opt-in)
• stream: new node:stream/iter module; test_runner: context.log(), entryFile; wasm: JSPI enabled
• crypto: root certificates updated to NSS 3.125

Two items I looked at specifically and cleared:

1. Root cert removals. nodejs/node#64746 is net-removal only — it drops Entrust Root Certification Authority (which expires 2026-11-27 regardless) and SecureSign Root CA12. This is the normal Mozilla NSS distrust cadence. It only matters for outbound TLS chains rooted at those two CAs; the UI reaches flow-api and the catalog over the internal network, and user-supplied CAs go through explicit peer config, so no impact is expected. Flagging as informational only.
2. http2 regression. nodejs/node#65677 (open) reports async iteration signalling a premature close with buffered responses, and explicitly names v24.20.0. Not applicable — there is no http2 usage anywhere under ui/, and the standalone Next server runs HTTP/1.1.

Other checks

• No new stdout/stderr/log output is introduced, so there is nothing to review for PII or secret leakage.
• docker-build (ubuntu-latest) passes on this PR, confirming the new base image builds.
• renovate/stability-days is still pending on minimum release age — expected, and it will clear on its own.

_{🤖 Generated with Claude Code}

[github-actions]

🔄 Flaky Test Detected

Analysis: The timing-sensitive toxiproxy test TestMySQLOnlyIntegrationSSHKeepaliveTunnelDown hit its 10s deadline waiting for a blocked query to error after the SSH tunnel broke, on a Renovate Node.js image-digest PR that touches no Go code, while a sibling matrix leg with the identical mysql-gtid flavor passed the same 4212 tests.
Confidence: 0.85

✅ Automatically retrying the workflow

View workflow run