[afoote-mitre]

Summary

Pin the Search API's dependency-build and runtime images to verified Node.js 24.22.1 base images, patch the transitive body-parser dependency to 1.20.9, and bump the project to 1.0.3-beta.

The runtime update addresses CVE-2026-111497 and the additional Node.js advisories fixed in 24.22.1. The dependency update addresses CVE-2026-111181 / GHSA-27r3-jxmh-p828, a process-crash vulnerability involving trailing bytes after compressed request bodies. Digest pins prevent separate environment builds from silently selecting different base-image revisions.

Changes and Rationale

Change	Primary files	Why it is needed
Pin the Node.js 24.22.1 Trixie-slim builder and Distroless runtime using immutable multi-architecture image digests	Dockerfile, Dockerfile.local	The floating runtime tag previously produced Node.js 24.22.0 in dev/test/int and patched 24.22.1 in production. Explicit digests make base selection consistent for a given architecture while retaining AMD64/ARM64 support. Non-root execution, production-only dependencies, and the local npm CA secret remain unchanged.
Align the quality workflow with the selected Node.js patch	.github/workflows/quality.yml	CI should exercise the same Node.js patch version used by the builder and runtime.
Require pinned references and matching Dockerfile inputs	config/runtime-config.test.js	Assertions detect floating references, mismatched local/production base images, and CI version drift while preserving packaging and hardening checks.
Update the locked transitive body-parser dependency from 1.20.6 to 1.20.9	package-lock.json	Node.js base-image rebuilds do not update dependencies locked by npm ci. The patched parser prevents the reported compressed-request process crash. Express remains at 4.22.2, and its existing dependency range permits the patch without an override or direct body-parser dependency.
Preserve binary test payloads and cover compressed-body processing	test/http.js, server.test.js	Ordinary corrupt-gzip coverage does not exercise errors arriving after decoding finishes. Focused cases cover valid gzip/deflate JSON on both endpoints, delayed gzip trailing bytes, and subsequent process liveness. The HTTP helper now preserves Buffer payloads instead of converting compressed bytes to text.
Bump the project patch version to 1.0.3-beta and regenerate its documented version	package.json, package-lock.json, api-docs/openapi.json	Package metadata, lockfile metadata, and the served OpenAPI document must identify the same patched application release. The API response-format version is unchanged.
Document deliberate image refreshes	README.md	Pinned images do not automatically receive security updates. Maintainers must verify replacement runtime versions and architectures, update both Dockerfiles, rebuild, scan, and redeploy.

Deployment and Maintenance

The runtime-only rebuilds already performed for dev/test/int updated Node.js but retained body-parser 1.20.6 from the existing lockfile. The dependency fix and 1.0.3-beta release require rebuilding and deploying application images after this PR is merged and promoted to each environment, including production.

Image-index digests preserve platform selection; they do not make AMD64 and ARM64 binaries identical or guarantee independently built application images have identical digests. Updating pinned digests remains a deliberate maintenance task.

Supersedes the image-pinning work in closed draft #181. No search-filter, endpoint schema, index, or credential changes are included.