From 7bde22713f2f9253ba70b4bb17c608c7f096853e Mon Sep 17 00:00:00 2001
From: Renovate Bot <renovate@larvit.se>
Date: Fri, 28 Aug 2026 04:18:08 +0000
Subject: [PATCH] Update Node.js to v24.20.0

Release-Bump: minor
---
 .gitea/workflows/registry-cleanup.yml | 2 +-
 .gitea/workflows/release.yml          | 6 +++---
 .gitea/workflows/renovate.yml         | 4 ++--
 Dockerfile                            | 2 +-
 compose.override.yml                  | 2 +-
 e2e-tests/compose.full.yml            | 6 +++---
 6 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.gitea/workflows/registry-cleanup.yml b/.gitea/workflows/registry-cleanup.yml
index 9a473af..a19ad0b 100644
--- a/.gitea/workflows/registry-cleanup.yml
+++ b/.gitea/workflows/registry-cleanup.yml
@@ -19,4 +19,4 @@ jobs:
         run: |
           docker run --rm -v "$PWD:/repo" -w /repo \
             -e REGISTRY_TOKEN -e REGISTRY_USER -e REPO_TOKEN -e REPOSITORY -e SERVER_URL \
-            node:24.19.0-alpine3.24 node registry-cleanup/cleanup.ts
+            node:24.20.0-alpine3.24 node registry-cleanup/cleanup.ts
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 975d9c5..8b08645 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -21,7 +21,7 @@ jobs:
           GIT_TAG: ${{ github.ref_name }}
         run: |
           set -euo pipefail
-          docker run --rm -v "$PWD:/repo" -w /repo node:24.19.0-alpine3.24 \
+          docker run --rm -v "$PWD:/repo" -w /repo node:24.20.0-alpine3.24 \
             node release-tooling/contract-version.ts "$GIT_TAG" src/plugin-host/plugin.ts
       - name: Promote the commit-hash image to semver + latest
         env:
@@ -98,9 +98,9 @@ jobs:
           VERSION=${INPUT_VERSION:-${GIT_TAG#v}}
           VERSION=${VERSION#v}
           # An empty dispatch input falls back to the branch name, so gate this like a tag.
-          docker run --rm -v "$PWD:/repo" -w /repo node:24.19.0-alpine3.24 \
+          docker run --rm -v "$PWD:/repo" -w /repo node:24.20.0-alpine3.24 \
             node release-tooling/contract-version.ts "$VERSION" src/plugin-host/plugin.ts
           docker run --rm -v "$PWD:/repo" -w /repo \
             -e DOCKERHUB_REPO -e DOCKERHUB_TOKEN -e DOCKERHUB_USER \
-            node:24.19.0-alpine3.24 \
+            node:24.20.0-alpine3.24 \
             node release-tooling/dockerhub-overview.ts "$VERSION"
diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index 599b35b..9c51c32 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -58,11 +58,11 @@ jobs:
           if [ -z "$BUMPS" ]; then
             echo "Renovate commits since ${LATEST}, but none carry Release-Bump — nothing reached a running Plainpages; skipping"; exit 0
           fi
-          NEXT=$(docker run --rm -v "$PWD:/repo" -w /repo node:24.19.0-alpine3.24 \
+          NEXT=$(docker run --rm -v "$PWD:/repo" -w /repo node:24.20.0-alpine3.24 \
                  node release-tooling/next-version.ts "$LATEST" $BUMPS)
           # Read the constant off origin/main, not the checkout, which lags the merges this run made.
           git show origin/main:src/plugin-host/plugin.ts \
-            | docker run -i --rm -v "$PWD:/repo" -w /repo node:24.19.0-alpine3.24 \
+            | docker run -i --rm -v "$PWD:/repo" -w /repo node:24.20.0-alpine3.24 \
                      node release-tooling/contract-version.ts "$NEXT" -
           echo "Releasing $LATEST -> $NEXT"
           git tag "$NEXT" origin/main
diff --git a/Dockerfile b/Dockerfile
index 689ccfe..222ada8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Node 24 runs TypeScript directly (type stripping) — no build step. Pinned exact tag.
-FROM node:24.19.0-alpine3.24
+FROM node:24.20.0-alpine3.24
 
 # Above WORKDIR so dev's `.:/app` bind mount can't shadow them; a volume at /app/node_modules
 # instead leaves a root-owned dir in the checkout (the daemon creates mount destinations as root).
diff --git a/compose.override.yml b/compose.override.yml
index f2fe007..b2fe9db 100644
--- a/compose.override.yml
+++ b/compose.override.yml
@@ -49,7 +49,7 @@ services:
   # backs it (PLUGIN_SETTING_SCHEDULING_UPSTREAM above points here). Stand-in for the customer's real service —
   # stdlib-only, in-memory, no auth. Prod points PLUGIN_SETTING_SCHEDULING_UPSTREAM at the real backend instead.
   shifts-upstream:
-    image: node:24.19.0-alpine3.24
+    image: node:24.20.0-alpine3.24
     command: node /srv/server.ts
     restart: unless-stopped
     volumes:
diff --git a/e2e-tests/compose.full.yml b/e2e-tests/compose.full.yml
index 7285000..00bad4e 100644
--- a/e2e-tests/compose.full.yml
+++ b/e2e-tests/compose.full.yml
@@ -53,7 +53,7 @@ services:
 
   # The reference plugin's upstream (examples/shifts-upstream) so /scheduling/shifts shows real rows.
   shifts-upstream:
-    image: node:24.19.0-alpine3.24
+    image: node:24.20.0-alpine3.24
     command: ["node", "/server.ts"]
     volumes:
       - ./examples/shifts-upstream/server.ts:/server.ts:ro
@@ -66,7 +66,7 @@ services:
   # Mock OIDC provider for the SSO login test — stdlib Node, auto-approves, signs an id_token Kratos
   # verifies via its jwks. Reachable as the same host (mock-oidc:9000) by both the browser and Kratos.
   mock-oidc:
-    image: node:24.19.0-alpine3.24
+    image: node:24.20.0-alpine3.24
     command: ["node", "/mock-oidc.ts"]
     environment:
       ISSUER: http://mock-oidc:9000
@@ -81,7 +81,7 @@ services:
 
   # Same-origin gateway: Kratos-owned paths → kratos, everything else → web (e2e-tests/proxy.ts).
   proxy:
-    image: node:24.19.0-alpine3.24
+    image: node:24.20.0-alpine3.24
     command: ["node", "/proxy.ts"]
     depends_on:
       web: