[SandObserver]

Summary

• Pin both Dockerfile stages to the node:24-alpine digest carrying Node.js 24.22.1 on Alpine 3.24.3.
• Node.js 24.22.1 fixes CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069 and CVE-2026-105481, and drops the emSign ECC Root CA - G3, Root CA - C1 and ECC Root CA - C3 roots from its bundled trust store.
• The rebuilt apk upgrade layer installs nginx 1.30.6-r0, fixing CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205.

Testing
All green, including the Docker build, the Trivy scan (no HIGH or CRITICAL findings) and the full e2e suite.

Changelog

Security

• Update Node.js to 24.22.1 and nginx to 1.30.6 to fix CVE-2026-111497, CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205, and stop trusting the compromised eMudhra certificate roots.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.