[NEXT-SECURITY-RELEASE] Heads up on upcoming Node.js security release 2026/07/29 #2574
Description
As per security release workflow, creating issue to give the docker team a heads up.
Pinned by MikeMcC399
MikeMcC399Publication status
All Dockerfiles have been passed to https://github.com/docker-library/official-images for image building and publication.
See Release availability for a description of how built images appear on Docker Hub with delay.
Ticked below when fully published on Docker Hub:
Activity
MikeMcC399 commentedon Jul 28, 2026
Delayed (at least) by one day
[-][NEXT-SECURITY-RELEASE] Heads up on upcoming Node.js security release 2026/07/27[/-][+][NEXT-SECURITY-RELEASE] Heads up on upcoming Node.js security release 2026/07/28[/+][-][NEXT-SECURITY-RELEASE] Heads up on upcoming Node.js security release 2026/07/28[/-][+][NEXT-SECURITY-RELEASE] Heads up on upcoming Node.js security release 2026/07/29[/+]RafaelGSS commentedon Jul 29, 2026
Security release is out
MikeMcC399 commentedon Jul 29, 2026
@RafaelGSS
Thanks for the heads-up! Good to hear you managed to get through the infrastructure issues! 🚀
MikeMcC399 commentedon Jul 29, 2026
nschonni commentedon Jul 29, 2026
docker-library/official-images#21944 should be building out the v22 images. Still waiting for the 24/26 ones to build out on the https://unofficial-builds.nodejs.org/logs/status.html
nroose commentedon Jul 29, 2026
nschonni commentedon Jul 30, 2026
nschonni commentedon Jul 30, 2026
Created a manual PR for 26 #2582, but I think the bot should open one with 26+24 in an hour or so
MikeMcC399 commentedon Jul 30, 2026
I've landed your PR for 26.5.1
Automation is still going wrong for the remaining 24.18.1, which https://nodejs.org/download/release/index.json correctly labels as a security release:
{ "version": "v24.18.1", "date": "2026-07-28", "files": [ "aix-ppc64", "headers", "linux-arm64", "linux-ppc64le", "linux-s390x", "linux-x64", "osx-arm64-tar", "osx-x64-pkg", "osx-x64-tar", "src", "win-arm64-7z", "win-arm64-zip", "win-x64-7z", "win-x64-exe", "win-x64-msi", "win-x64-zip" ], "npm": "11.16.0", "v8": "13.6.233.17", "uv": "1.52.1", "zlib": "1.3.1", "openssl": "3.5.7", "modules": "137", "lts": "Krypton", "security": true },https://github.com/nodejs/docker-node/actions/runs/30521223827/job/90801847376
22.23.1 & 26.5.1 from the security release are already up to date and dealt with, there is only 24.18.1 still to do, and that should not be waiting for a musl build.
https://unofficial-builds.nodejs.org/ has yet to start processing 24.18.1. It is still busy with other builds for 26.5.1.
Given that any PRs submissions to https://github.com/docker-library/official-images generally don't get merged until the PDT USA time zone working day (UTC-7), there would be no advantage in manually putting together a PR for 24.18.1 Debian without Alpine right now. That would however be a back-stop solution if there is no musl build for 24.18.1 produced in the next 8 hours, in other words by 15:00 UTC.
MikeMcC399 commentedon Jul 30, 2026
MikeMcC399 commentedon Jul 30, 2026
#2584 has completed a full set of variants (Debian and Alpine) for Node.js 24.18.1.
All actions for the July 2026 security release necessary in this repo have now been completed.
Leaving this issue open until docker-library/official-images#21951 has landed.
Work to fix the automation so it correctly handles security releases in future is however still outstanding.
MikeMcC399 commentedon Jul 30, 2026
Publication status
All Dockerfiles have been passed to https://github.com/docker-library/official-images for image building and publication.
See Release availability for a description of how built images appear on Docker Hub with delay.
Ticked below when fully published on Docker Hub:
nroose commentedon Jul 30, 2026
MikeMcC399 commentedon Jul 30, 2026