chore(docker): bump Node base image, pnpm and pack to pick up security fixes - #5737

What is this PR about?

Bumps the pinned tooling in the Dokploy image so the published image stops shipping known, already-fixed HIGH/CRITICAL CVEs (see #5736):

• Base image node:24.4.0-slim → node:24.22.1-bookworm-slim. Picks up the Node.js 24 security releases since July 2025 and refreshed Debian 12 packages (12.11 → 12.15: libgnutls30, libpam*, libpcre2-8-0, gpgv, git-lfs). I pinned -bookworm explicitly so the distro stays the same, because the plain -slim tag now resolves to trixie.
• pnpm 10.22.0 → 10.34.7 (corepack in all Dockerfiles, packageManager fields, CI pnpm/action-setup). The copy that ships in the runtime image had 14 HIGH advisories. Same lockfile format, so pnpm install --frozen-lockfile works unchanged.
• pack buildpacksio/pack:0.39.1 → 0.40.10 (Go stdlib, x/crypto, go-git, buildkit, kaniko).
• .nvmrc, CI node-version and CONTRIBUTING.md are kept in sync with the new Node version. engines (^24.4.0) is left alone, since it's a lower bound.

Railpack (0.15.4) and Docker (28.5.2) are left out on purpose. Bumping them changes build behaviour and Docker API compatibility, so they deserve their own discussion.

Trivy results (HIGH/CRITICAL, fixable only, unique findings)

How it was tested

• docker build . succeeds (after cp apps/dokploy/.env.production.example .env.production, as CI does).
• I ran the image against a fresh postgres:16 and redis:7 on an isolated network. Migrations ran, workers started, /api/trpc/settings.health returned 200 in about 15s, and / redirected to /register (200).
• Versions inside the container: node v24.22.1, pnpm 10.34.7, pack 0.40.10, railpack 0.15.4, Docker 28.5.2.

Checklist

• You created a dedicated branch based on the canary branch.
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance.

Issues related (if applicable)

Refs #5736. This covers the image/tooling part of that issue. The other part (shipping #5517 / Next.js 16.3.8 in a stable release) needs a release from canary.

🤖 Generated with Claude Code

Confidence Score: 5/5

Summary

Updates the tooling pinned in Dokploy images.

• Dokploy images use newer Node, pnpm, and pack versions.
• CI and local setup use the same pinned Node and pnpm versions.

_{Reviews (1) · Last reviewed commit: "chore(docker): bump Node base image, pnp..." · Reviewed by Greptile}