BREAKING CHANGE(node-dep): Update Node.js 24.22.2 → 26.13.0 - #4607

git diff 5bc223a766e9e2c8eab045f881bea22f7dec9861 6d8f521200853de31c000813a3bd4f894b39013b -- apps/seerr/Dockerfile
printf '\n--- Seerr Dockerfile ---\n'
nl -ba apps/seerr/Dockerfile
printf '\n--- Node image files ---\n'
ls apps/node
nl -ba apps/node/Dockerfile
nl -ba apps/node/docker-bake.hcl
printf '\n--- Corepack references ---\n'
rg -n -i 'corepack|27e759f51e7eb4c2e4c1fbb446dc92d016989beed0cf321b7f85672159712b2b' apps/node apps/seerr include .github || test "$?" -eq 1

printf '%s\n' '--- Ubuntu image Dockerfile ---'
nl -ba apps/ubuntu/Dockerfile
printf '%s\n' '--- Node copied files and allowlist ---'
nl -ba include/.dockerignore
find apps/node -maxdepth 3 -type f -print
printf '%s\n' '--- Pinned image registry metadata ---'
python3 - <<'PY'
import json, urllib.request
repo='trueforge-org/node'
digest='sha256:27e759f51e7eb4c2e4c1fbb446dc92d016989beed0cf321b7f85672159712b2b'
try:
    token=json.load(urllib.request.urlopen('https://ghcr.io/token?scope=repository:'+repo+':pull', timeout=15))['token']
    def get(path, accept):
        req=urllib.request.Request('https://ghcr.io/v2/'+repo+'/'+path, headers={'Authorization':'Bearer '+token,'Accept':accept})
        with urllib.request.urlopen(req, timeout=15) as r:
            return json.load(r)
    accept='application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json'
    manifest=get('manifests/'+digest, accept)
    print('index:', json.dumps(manifest, indent=2))
    if 'manifests' in manifest:
        amd=next(x for x in manifest['manifests'] if x.get('platform',{}).get('architecture')=='amd64' and x.get('platform',{}).get('os')=='linux')
        manifest=get('manifests/'+amd['digest'], accept)
    print('image manifest:', json.dumps(manifest, indent=2))
    config=get('blobs/'+manifest['config']['digest'], 'application/octet-stream')
    print('image config:', json.dumps(config, indent=2))
except Exception as e:
    print('REGISTRY INSPECTION FAILED:', repr(e))
PY

printf '%s\n' '--- Pinned image source revision ---'
git cat-file -t 320431dc092a05019a71aa214439b8c15e2936e6 2>&1 || :
printf '%s\n' '--- Archive tools ---'
command -v zstd || :
command -v unzstd || :
printf '%s\n' '--- Inspect image copy layers ---'
python3 - <<'PY'
import ctypes, ctypes.util, io, json, tarfile, urllib.request
repo='trueforge-org/node'
layers=[
'sha256:00949c8d052a8cc34bc2ff6d1b7f4d09f1f042aa09f85161c809d64ace05aeab',
'sha256:9532b5a4c6b8c6fb8f570b63b7ad8ae6847c0be09b6ab3fa8e79f280a94d9bce',
'sha256:0e24abface089d30baa52184dd91c03136578d565de766a02856cd070a346b51']
try:
    token=json.load(urllib.request.urlopen('https://ghcr.io/token?scope=repository:'+repo+':pull',timeout=15))['token']
    lib=ctypes.CDLL(ctypes.util.find_library('zstd'))
    lib.ZSTD_getFrameContentSize.argtypes=[ctypes.c_void_p,ctypes.c_size_t]
    lib.ZSTD_getFrameContentSize.restype=ctypes.c_ulonglong
    lib.ZSTD_decompress.argtypes=[ctypes.c_void_p,ctypes.c_size_t,ctypes.c_void_p,ctypes.c_size_t]
    lib.ZSTD_decompress.restype=ctypes.c_size_t
    lib.ZSTD_isError.argtypes=[ctypes.c_size_t]
    lib.ZSTD_isError.restype=ctypes.c_uint
    for digest in layers:
        req=urllib.request.Request('https://ghcr.io/v2/'+repo+'/blobs/'+digest,headers={'Authorization':'Bearer '+token})
        data=urllib.request.urlopen(req,timeout=20).read()
        src=ctypes.create_string_buffer(data)
        size=lib.ZSTD_getFrameContentSize(src,len(data))
        if size>10_000_000:
            print(digest, 'frame size unavailable or too large:',size); continue
        dst=ctypes.create_string_buffer(size)
        out=lib.ZSTD_decompress(dst,size,src,len(data))
        if lib.ZSTD_isError(out): print(digest,'decompression error'); continue
        with tarfile.open(fileobj=io.BytesIO(dst.raw[:out]),mode='r:') as tf:
            print(digest, 'paths:', ', '.join(x.name for x in tf.getmembers()))
except Exception as e:
    print('LAYER INSPECTION FAILED:',repr(e))
PY

set -o pipefail
repo=trueforge-org/node
token=$(python3 -c 'import json,urllib.request; print(json.load(urllib.request.urlopen("https://ghcr.io/token?scope=repository:trueforge-org/node:pull",timeout=15))["token"])') || exit 1
for digest in \
dd4e7074e93377bcf66c37528ca394f1b2c1131739ef555aae06b4838b5fbdde \
cfd8859a4e6c304dd49d6c6482f1718b2d920da588cba573ce20211973274e0f \
5c6937a51d4beff4a2cad23fa712e554621538fef995f425ddd9d383ef0a62b9 \
c3266bbe9460b1d4819d8b38f24cf56e6639d4e79d37b7d1375b39d46e4d026e \
1cb63ba287d1c65b39d42f221df0f07e561b355b9bf9946a80835eb21f4f658a \
c51cc41ee828c63f67919e4b832adc4c9987ae9722995c58e7a606545f623943 \
00949c8d052a8cc34bc2ff6d1b7f4d09f1f042aa09f85161c809d64ace05aeab \
177ce584a4ff8ed50a3926706f0c2bf3f728fe1480e024f44692eddbed7692ba \
9532b5a4c6b8c6fb8f570b63b7ad8ae6847c0be09b6ab3fa8e79f280a94d9bce \
2c1ce468d9f3d941396801f6e3afc8921466650dd05430fe644cd3537713d27f \
77da9053ae4f309b9a137f68cd506930a3ef430089c320c5bdcaadf9f9604003 \
552e3ae518ed815a4240f20958264f01f95f8484a90406b80b28187b05a3a032 \
0e24abface089d30baa52184dd91c03136578d565de766a02856cd070a346b51; do
  printf 'layer %s: ' "$digest"
  if curl -fsSL --max-time 80 -H "Authorization: Bearer $token" "https://ghcr.io/v2/$repo/blobs/sha256:$digest" | zstd -dc | tar -tf - | awk 'BEGIN { n=0 } /[Cc]orepack/ {print; n++} END {if (!n) print "no Corepack paths"}'; then
    :
  else
    echo "LAYER READ FAILED"
    exit 1
  fi
done