[eruizgar91]

Summary

Moves the tutorials images and the showcase CI job off Node.js 20, which is end-of-life and gets no fix for the October 2026 Node.js security releases (4 High CVEs on 24.x, including CVE-2026-111497, a Brotli decoder out-of-bounds write that allows RCE, and two TLS certificate hostname bypasses: CVE-2026-105483 and CVE-2026-106069).

Changes

• showcase/Dockerfile: node:20-alpine → node:24-alpine in all three stages (deps, build, runner). This is the image showcase-image.yml publishes; it runs in production as tutorials-showcase.
• mcp-examples/weather-mcp/Dockerfile: node:20-alpine → node:24-alpine.
• .github/workflows/showcase-image.yml: setup-node "20" → "24". setup-node installs from nodejs.org, so this is already 24.22.1.

Not changed, on purpose

• http-simple-agent-ts/Dockerfile stays on node:22-alpine, which is a floating tag on a supported line.
• The other setup-node pins ("22", "22.x") are floating on a supported line.
• engines / README "Node 18+" lines are minimums, not pins.

Important: the images are not patched yet

The floating node:24-alpine tag still runs v24.22.0 on 2026-10-21. Docker Hub has not moved it to 24.22.1 yet, and node:24.22.1-alpine has no linux/amd64 image. So this PR takes the images off end-of-life Node 20 now. They pick up the October fixes when they are rebuilt after Docker Hub updates the tag. The same applies to the weather-x402 image (node:22-alpine, still 22.23.2).

Testing

• docker build -f showcase/Dockerfile . succeeded (npm ci + next build); node -v in the image is v24.22.0.
• docker build mcp-examples/weather-mcp succeeded (yarn install + yarn build).

After merge

Publish a new tutorials-showcase image and bump its sha tag in argocd. Then rebuild showcase and weather-x402 once Docker Hub updates the Node tags.

Refs nevermined-io/nvm-monorepo#4611

🤖 Generated with Claude Code

[r-marques]

👀 Reviewing

[r-marques]

🤖 Automated PR review — ✅ Ready to merge

This PR moves the showcase and weather-mcp images and the showcase workflow from Node 20 (past end of life) to 24. Every Node 20 pin is gone. The remaining Node 22 pins are on a supported line with its own patched release.

What I reviewed

• 3 files. Grepped for Node pins: only Node 22 remains (3 places) plus a planning doc.
• CI: Verify (build + sandbox self-check) passes. The image push job is skipped, as expected on a PR.
• Not verified: the weather-mcp image build on Node 24 (no job builds it on a PR).

Verdict: ✅ Ready to merge: 0 blockers, 0 should-fix, 0 nits.

🧭 Inline comments (1)

Each is posted on its line in Files changed.

• ✅ NICE — Every Node 20 pin moves to 24, and the showcase build is green — showcase/Dockerfile:13

[r-marques]

✅ Approved — no blockers, nothing to address.

Inline review: #83 (review)