Base sandbox build broken: NodeSource yanked pinned Node.js 22.22.1 package

Open

#56 opened on Mar 29, 2026 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 3/5
Estimated time: 1-2 days
Newbie friendliness: 68/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Quiet
Tech stack: docker, github-actions, node.js
Domain: build-system, ci-cd, devops

Research direction

Start with sandboxes/base/Dockerfile at line 61 and the Build Sandbox Images workflow, then reproduce the failed build to confirm the unavailable NodeSource pin. Compare the proposed installation approaches and verify that the chosen approach builds the base sandbox image successfully without depending on the missing package version.

Written by the indexing model from the issue text.

Description

Summary

The Build Sandbox Images workflow is failing because NodeSource removed nodejs=22.22.1-1nodesource1 from their apt repository. The base sandbox Dockerfile pins this exact version at line 61, causing the Docker build to fail with:

E: Version '22.22.1-1nodesource1' for 'nodejs' was not found

Failed run: https://github.com/NVIDIA/OpenShell-Community/actions/runs/23721670468

Root Cause

NodeSource has a recurring issue where they publish patch releases to their apt repo and then remove them shortly after, keeping only the .0 release. This is documented in multiple upstream issues:

nodesource/distributions#1931 — opened Mar 28, 2026, reports 22.22.1, 22.22.2, 20.20.1, 20.20.2, 24.14.1 all missing
nodesource/distributions#1897 — same pattern observed with 22.21.1 back in Nov 2025

The version 22.22.1-1nodesource1 was available when the pin was introduced in commit d5073c3 (Mar 12) and built successfully as recently as Mar 24 (run 23503799247). NodeSource yanked it between Mar 24–28.

The highest version currently available in the NodeSource repo is 22.22.0-1nodesource1.

Suggested Fix

Pinning to NodeSource apt packages is unreliable since they remove versions without notice. Consider one of:

Install from official Node.js tarballs — download pre-built binaries directly from https://nodejs.org/dist/ which are never removed. This is the most robust option.
Pin to the latest available NodeSource version (22.22.0-1nodesource1) as a short-term fix, accepting it will likely break again on the next patch release cycle.
Remove the version pin and just install nodejs without a version suffix, trading reproducibility for resilience.

Option 1 is recommended since it avoids this class of problem entirely.

Dominant language: Dockerfile
Stars: 191
Forks: 76
PR merge metrics: No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Use zstd compression? Open

Needs Design Priority: Wishlist

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

elementary/flatpak-platform#253 · Opened Sep 20, 2026
`Docker.available()` waits on the one-hour build timeout, so a wedged daemon blocks the build for an hour on a boolean probe Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

objectionary/hone-maven-plugin#1060 · Opened Sep 20, 2026
Build failure: cyberstrike on aarch64-linux (node_modules FOD hash is x86_64-only) Open

0.kind: build failure

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

NixOS/nixpkgs#565337 · Opened Sep 20, 2026
Update Vish to 1.1.5 Open

package-update

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

oSoWoSo/vOid_Community_repOsitory#144 · 1 comment · Opened Sep 20, 2026
Tsavorite.test fails to compile on main: TestBase.cs references Garnet.test.TestUtils, which is not linked into Tsavorite.test.csproj Open

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

microsoft/garnet#2161 · 2 comments · Opened Sep 20, 2026

More Build System issues