fix(cli): deploy node 22, 24 and 26 tasks on the October 2026 Node.js security releases

Pins the deploy base images built on Node.js 22.23.4, 24.22.1 and
26.12.1, which fix CVE-2026-111497 (Brotli decoder out-of-bounds write)
and several TLS hostname verification bypasses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: ericallam

.changeset/node-october-2026-security-images.md

@@ -0,0 +1,5 @@
+---
+"trigger.dev": patch
+---
+
+Deployed tasks on the `node-22`, `node-24` and `node-26` runtimes (and the default `node` runtime) now run on Node.js 22.23.4, 24.22.1 and 26.12.1, the October 2026 security releases. They fix CVE-2026-111497 (an out-of-bounds write in the Brotli decoder) and several TLS hostname verification bypasses. Redeploy with this CLI version to pick up the patched runtime.

packages/cli-v3/src/deploy/buildImage.test.ts

@@ -36,18 +36,18 @@ describe("formatCommandForDiagnostics", () => {
 const images: Array<[BuildRuntime, string, string]> = [
   [
     "node",
-    "triggerdotdev/node:24-bookworm@sha256:d2d0c01822409f6d2de1cc69a9e718424048fa12fc64b223dfa84f6db44d0ffd",
-    "triggerdotdev/node:24-bookworm-build@sha256:19322289508ae9b4be0b769acac179637e4b57d363844682f4b116feb951267d",
+    "triggerdotdev/node:24-bookworm@sha256:3cdc82425d824f1059fddd64b881947bf8edf4f0a5a9176145dba4889f8731ff",
+    "triggerdotdev/node:24-bookworm-build@sha256:34a3f4554d1684e078b104bd2b7ba6743776ad9002ebceef707dee91fa629c41",
   ],
   [
     "node-24",
-    "triggerdotdev/node:24-bookworm@sha256:d2d0c01822409f6d2de1cc69a9e718424048fa12fc64b223dfa84f6db44d0ffd",
-    "triggerdotdev/node:24-bookworm-build@sha256:19322289508ae9b4be0b769acac179637e4b57d363844682f4b116feb951267d",
+    "triggerdotdev/node:24-bookworm@sha256:3cdc82425d824f1059fddd64b881947bf8edf4f0a5a9176145dba4889f8731ff",
+    "triggerdotdev/node:24-bookworm-build@sha256:34a3f4554d1684e078b104bd2b7ba6743776ad9002ebceef707dee91fa629c41",
   ],
   [
     "node-26",
-    "triggerdotdev/node:26-bookworm@sha256:0e9b19f814f32d3766a8cf167835a499349df5bd34702611577b1f75bc2d2026",
-    "triggerdotdev/node:26-bookworm-build@sha256:de5cdfd683dabad582182c79779135d59faac0e6893b6cf04520d5a0dc826dd7",
+    "triggerdotdev/node:26-bookworm@sha256:e319f1134f8d4228be3adda596d1b97568f8eb09a3fbdac736594d0cbbd7e5cb",
+    "triggerdotdev/node:26-bookworm-build@sha256:86d5a599fc69a81e15c1276440702144cd3d857258fdaf78f8c9b864768c1ab9",
   ],
   [
     "bun",

packages/cli-v3/src/deploy/buildImage.ts

@@ -711,24 +711,24 @@ export type GenerateContainerfileOptions = {
 // Prebuilt in base-images/; both maps must be bumped together, from one publish run
 export const BASE_IMAGE: Record<BuildRuntime, string> = {
   bun: "triggerdotdev/bun:1.3-node20-bookworm@sha256:25b467196277b9d75a37773ee36d28b65ca81a6f41786f7d7d7f1fad95fb5a31",
-  node: "triggerdotdev/node:24-bookworm@sha256:d2d0c01822409f6d2de1cc69a9e718424048fa12fc64b223dfa84f6db44d0ffd",
+  node: "triggerdotdev/node:24-bookworm@sha256:3cdc82425d824f1059fddd64b881947bf8edf4f0a5a9176145dba4889f8731ff",
   "node-22":
-    "triggerdotdev/node:22-bookworm@sha256:3d1b59a1d50c3df713078a7b18386441cf7fdbaeea6da799247df5a2e180bdd5",
+    "triggerdotdev/node:22-bookworm@sha256:40c519460ee37b51a8f3c6286e9aeb910231dec01e4d655fa8164cc28fbad5f2",
   "node-24":
-    "triggerdotdev/node:24-bookworm@sha256:d2d0c01822409f6d2de1cc69a9e718424048fa12fc64b223dfa84f6db44d0ffd",
+    "triggerdotdev/node:24-bookworm@sha256:3cdc82425d824f1059fddd64b881947bf8edf4f0a5a9176145dba4889f8731ff",
   "node-26":
-    "triggerdotdev/node:26-bookworm@sha256:0e9b19f814f32d3766a8cf167835a499349df5bd34702611577b1f75bc2d2026",
+    "triggerdotdev/node:26-bookworm@sha256:e319f1134f8d4228be3adda596d1b97568f8eb09a3fbdac736594d0cbbd7e5cb",
 };
 
 export const BUILD_IMAGE: Record<BuildRuntime, string> = {
   bun: "triggerdotdev/bun:1.3-node20-bookworm-build@sha256:a2d5e6d1ec25946ca1d86abdd9ffb9c589376df64ee1b490c461607953931245",
-  node: "triggerdotdev/node:24-bookworm-build@sha256:19322289508ae9b4be0b769acac179637e4b57d363844682f4b116feb951267d",
+  node: "triggerdotdev/node:24-bookworm-build@sha256:34a3f4554d1684e078b104bd2b7ba6743776ad9002ebceef707dee91fa629c41",
   "node-22":
-    "triggerdotdev/node:22-bookworm-build@sha256:acc6f0143021f532b601bf9fa2cd7745b07612358f94acb8e1cd864468320a81",
+    "triggerdotdev/node:22-bookworm-build@sha256:7a4395f00b0939040f17a988a5fa49c5386992f88bc1ba1dd2e35bec610cf735",
   "node-24":
-    "triggerdotdev/node:24-bookworm-build@sha256:19322289508ae9b4be0b769acac179637e4b57d363844682f4b116feb951267d",
+    "triggerdotdev/node:24-bookworm-build@sha256:34a3f4554d1684e078b104bd2b7ba6743776ad9002ebceef707dee91fa629c41",
   "node-26":
-    "triggerdotdev/node:26-bookworm-build@sha256:de5cdfd683dabad582182c79779135d59faac0e6893b6cf04520d5a0dc826dd7",
+    "triggerdotdev/node:26-bookworm-build@sha256:86d5a599fc69a81e15c1276440702144cd3d857258fdaf78f8c9b864768c1ab9",
 };
 
 // Preinstalled in the published base images; must match base-images/images.json