[indietyp]

🌟 Purpose

Pin Brunch's Docker build and runtime to Node.js 22.23.4 and restore Node's default certificate store. Keep the OS CA-package requirement unchanged.

⚠️ Known issues

• Breaking: Node.js no longer trusts private CAs installed only in the OS store. Supply them through NODE_EXTRA_CA_CERTS or the client's ca option.
• The Dockerfile copies an absent server/ directory. Update its server copy and startup paths before building the application image.

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[cursor]

PR Summary

Medium Risk
TLS trust behavior changes in the container: workloads that relied on OS-only private CAs via --use-openssl-ca must use NODE_EXTRA_CA_CERTS or client ca options instead.

Overview
Pins the Brunch Docker base image from node:22-bookworm-slim to node:22.23.4-bookworm-slim for reproducible build and runtime Node versions.

Removes NODE_OPTIONS=--use-openssl-ca and its comment so Node uses its default certificate store again instead of forcing the system OpenSSL trust store. The existing ca-certificates apt install and minimum version check are unchanged.

^{Reviewed by Cursor Bugbot for commit bf8845f. Bugbot is set up for automated code reviews on this repo. Configure here.}