Bump base image node/alpine version

[IsaacG]

No description provided.

[joshgoebel]

Please explain why this is better than the un-tagged version. This prevents security updates for one, would it not?

[IsaacG]

Please explain why this is better than the un-tagged version. This prevents security updates for one, would it not?

Are you referring to node:lts-alpine vs node:24.18.0-alpine3.24 or using a hash/pin unpinned?

The former makes zero difference when pinned. The label is ignored and the hash is used. Either is fine. The full version gives the pin context.

Re: pinning, there are a bunch of things at play. It's nuanced and involved and complicated :)

• You only get security updates when the image is actually rebuilt. Having no hash doesn't magically get you updates. It also makes it harder to know what version is actually in use, to know if an update is needed. If you use a recent pinned version, you actually get routine updates via Dependabot. Dependabot is usually pretty good at flagging specific versions with security issues.
• Not pinning versions is a security risk. There's been a number of supply chain attacks where the latest version is compromised and pulling in the latest version has led to security issues.
• Using the latest version has a nasty tendency to break builds when the latest version has breaking changes. Builds that previously worked fine can unexpectedly stop building on PRs that seem entirely unrelated to the error. With a pinned version, you have a stable version that can reproducibly build.
• I believe it is mostly due to the last point that it is Exercism's preference/policy (per Erik and/or Jeremy) to prefer pinning things when possible.
• Since this is the Exercism preference, this is what ought to be done.
• One of the bigger financial costs to Exercism is per Jeremy is Docker image storage costs. By pinning the base layer and using common hashes across the different track tooling, fewer base images that needs to be stored, reducing Exercism's financial costs.

I hope that all helps!