Distillation

["03c58b8ce6386e71c1c0c66fedf03b21","aea2170d44f099a6a24479df99a9194d","3dc570d27cc4877cf30bd0d3a92c6fad","99447ea6754ca8d94b3207cf69839b1c","833af18f90041c48f4cc47960b3ab691","671e8a157bc50c94b1b19ee46d4b0b25","0e29385f42e45bc5853d8574479e18f4","645e4dabecbaa3609ff3a58be7dfeaa7","4d75a153f79acbe6cd890c73bbfc790e","4de9d19c7f7693a25f6fea9645656f24","e2923241815e6d486497235bf1de5587"]

<observations> Date: June 24, 2026 * 🟡 (08:39) Dockerfile confirmed: uses floating base images `node:22-bookworm-slim` (line 1, builder stage) and `node:22-bookworm` (line 20, final stage) — no pinned patch version; this is the root cause of the incident * 🟡 (08:39) craft package.json: name `@sentry/craft`, version `2.26.8`; Volta config pins `node: 22.12.0`, `pnpm: 10.27.0`; Volta pin predates regression (22.12.0 < 22.23.0) so local/CI dev unaffected * 🟡 (08:39) craft Dockerfile installs: twine==6.1.0, pkginfo==1.12.1.2 (pip); cocoapods v1.16.2 (gem, pinned); symbol-collector 1.17.0 (getsentry/symbol-collector); flutter_linux_3.22.0-stable; PowerShell v7.4.1; dotnet-sdk-9.0, dotnet-sdk-8.0; docker-ce-cli, docker-buildx-plugin; erlang, elixir; cargo-hack; maven * 🟡 (08:39) Node 22.x release dates confirmed: v22.23.0 released 2026-06-17 (buggy, CVE-2026-48931 patch introduced regression); v22.23.1 released 2026-06-22 (regression fixed via PR #64004 backport) * 🟡 (08:39) Docker Hub tag verification: `node:22.23.1-bookworm-slim` → HTTP 200; `node:22.23.1-bookworm` → HTTP 200; `node:22.23.0-bookworm-slim` → HTTP 200 * 🟡 (08:39) No Dependabot (`no dependabot.yml`) and no Renovate (`no renovate`) configured in craft repo — floating base image has no automated bump guardrail * 🟡 (08:39) craft CI workflows use Node via: `actions/setup-node@v6` with `node-version: '22'` (docs-preview.yml line 20); `node-version-file: package.json` (lint.yml line 18, build.yml lines 56, 98); build matrix `node: ['22', '24']` (build.yml line 21) — CI uses mocked network I/O (nock), so regression not caught by tests * 🟡 (08:39) Only 2 lines in craft repo need changing for the fix: Dockerfile line 1 (`node:22-bookworm-slim` → `node:22.23.1-bookworm-slim`) and line 20 (`node:22-bookworm` → `node:22.23.1-bookworm`); `temp_work/` and `temp_update_sha/` Dockerfile hits are unrelated scratch dirs * 🟡 (08:40) Plan written to `.opencode/plans/1782290100699-sunny-mountain.md`; fix rationale: pinning exact version preferred over relying on floating tag rebuild since unguarded float caused the incident; building fixed image does not touch GCS so broken `:latest` won't block producing the fix * 🟡 (08:40) Recovery path: