Published Docker image is built on node:18-alpine, end-of-life since 2025-04-30

Hello, and thank you for NextChat.

The published Docker image is built on a Node line that stopped receiving security fixes fifteen months ago, and I think it's worth a look.

## What I observed

`Dockerfile` builds every stage from one base, including the one that becomes the image:

```
1: FROM node:18-alpine AS base
3: FROM base AS deps
14: FROM base AS builder
28: FROM base AS runner <-- the shipped stage
47: EXPOSE 3000
```

So `runner` inherits `node:18-alpine`. This isn't a build-only base that gets discarded — it's what ships, via `.github/workflows/docker.yml`.

**Node 18 reached end-of-life on 2025-04-30.** The supported lines today are 22, 24 and 26.

## Why that matters more than a version number

Node.js states the consequence directly in its security-release notes:

> "It's important to note that **End-of-Life versions are always affected** when a security release occurs."

The June 2026 release fixed **twelve CVEs**, patched into 22.x, 24.x and 26.x — and not into 18.x:

| CVE | Severity | |
|---|---|---|
| CVE-2026-48933 | **HIGH** | WebCrypto AES integer overflow → remote process abort (DoS) |
| CVE-2026-48618 | **HIGH** | Unicode dot separator → TLS wildcard-depth authentication bypass |
| CVE-2026-48934 | Medium | TLS host identity verification bypass via session reuse |
| CVE-2026-48928 | Medium | Uppercase SNI matching → mTLS authorization bypass |
| CVE-2026-48615 | Medium | Proxy credentials leaked in `ERR_PROXY_TUNNEL` error message |

The July 2026 release, published this week, again patched only 26.x/24.x/22.x, with *"the highest severity issue fixed in this release is HIGH."* That's one release out of fifteen months of them.

## Why nothing would have told you

`node:18-alpine` keeps resolving perfectly well — it just stops being fixed, silently. Dependabot's `docker` ecosystem is documented as doing *version* updates but **not security updates**, so a base image going end-of-life raises no alert at all.

## What I did NOT check

- I did not pull or scan the published image; this is an analysis of the Dockerfile that builds it.
- I did not determine which of those CVEs are reachable in NextChat's usage, and I'm **not** claiming any of them is exploitable here. The narrower claim is that an end-of-life runtime ships and structurally cannot receive these fixes.
- I did not assess Alpine's own package set separately.

## Suggestion

Moving the base to `node:22-alpine` or `node:24-alpine` would put it back on a patched line. I'm happy to open the PR if that's useful — it's a one-line change plus a build/test pass for the major bump.

*Disclosure: AI-assisted (Claude Opus 5). I verified the Dockerfile stages, the Node EOL dates from endoflife.date, and the CVE list from nodejs.org myself before posting.*

Start with Dockerfile and inspect the base image used by the deps, builder, and runner stages, then review .github/workflows/docker.yml to confirm how the published image is built. Update the shipped runtime to a supported Node Alpine line, choosing between the versions suggested in the issue, and verify that the Docker build and tests pass.

Written by the indexing model from the issue text.