[Aymericr]

What does this PR do?

Pins the runtime stage of the self-host image (ghcr.io/pascalorg/pascal-editor) from the floating node:22-alpine to node:22.23.4-alpine, the Node 22 security release of 2026-10-20 (listed with security: true in nodejs.org's release index; the 22.23.4-alpine tag exists on Docker Hub). One-line change in Dockerfile; no workflow changes.

How to test

1. The Docker image workflow (docker.yml) runs on this PR because Dockerfile changed: it builds the image and smoke-tests health, the login gate, a signed-in save and public embeds. Expect it to pass.
2. Optionally, locally: docker build -t pascal-editor:test . && docker run --rm pascal-editor:test node --version should print v22.23.4.

Screenshots / screen recording

N/A — non-visual change

Checklist

• I've tested this locally with bun dev
• My code follows the existing code style (run bun check to verify)
• I've updated relevant documentation (if applicable)
• This PR targets the main branch

  

---

Note

Low Risk
Single-line base image pin for reproducibility and security patches; no application or workflow logic changes.

^{Reviewed by Cursor Bugbot for commit e04ca9e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T22:56:50.028749Z	e04ca9e	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.