Upgrades the Docker build and production runtime from end-of-life Node 20 to Node.js 24.22.2. This includes the Brotli decoder security fix for CVE-2026-111497 first released in Node 24.22.1, plus the subsequent Node 24 patch fixes. Addresses #39 via #42.
- Aligns CI and local development with Node 24.22.2 using
.nvmrc. - Publishes Linux amd64 and arm64 images after unit tests, production builds, container API tests, scheduler initialization, and exact runtime-version checks.
- Updates Docker Hub tags
3.2.12,latest, andstableindh1011/subscription-manager.
Validation of the runtime upgrade included 21 unit tests, TypeScript checks, 12 production-container API tests, and 26 passing Chromium GUI scenarios. Three existing GUI behaviors remain unchanged: currency-name search fails, importing into a populated list hides existing entries until reload, and repeated imports append duplicates. GUI testing used synthetic data and local notification stubs; external fonts/icons and other browsers were not fully verified.
No application feature, UI, or database-schema changes are included. App-specific exploitability of the Node vulnerability was not established.
Pull dh1011/subscription-manager:3.2.12 (or latest / stable) and recreate the container while retaining the existing data volume.
References: Node security advisory, Node 24.22.2 release.