fix(docker): bump Node base images to 22.23.4 for CVE-2026-111497

Node 22.23.3 bundles a Brotli decoder vulnerable to CVE-2026-111497
(buffer overflow in DecodeBlockTypeAndLength); 22.23.4 is the fixed
22.x release.

Co-authored-by: Jiazhen Fan <jfan@heygen.com>
Co-Authored-By: Claude <noreply@anthropic.com>

Dockerfile.test

@@ -10,7 +10,7 @@
 #   docker run --rm -v ./packages/producer/tests:/app/packages/producer/tests hyperframes-producer:test
 #   docker run --rm -v ./packages/producer/tests:/app/packages/producer/tests hyperframes-producer:test --update
 
-FROM node:22.23.3-bookworm-slim
+FROM node:22.23.4-bookworm-slim
 
 # ── System dependencies (identical to production) ────────────────────────────
 RUN apt-get update && apt-get install -y --no-install-recommends \

packages/cli/src/docker/Dockerfile.render

@@ -1,4 +1,4 @@
-FROM node:22.23.3-bookworm-slim
+FROM node:22.23.4-bookworm-slim
 
 ARG HYPERFRAMES_VERSION=latest
 # Set automatically by `docker build --platform` (BuildKit); selects the

packages/gcp-cloud-run/Dockerfile

@@ -21,7 +21,7 @@
 # Unlike the AWS Lambda adapter there is no ZIP-size ceiling and no runtime
 # Chrome decompression step — the binary lives in the image at a fixed path.
 
-FROM node:22.23.3-bookworm-slim AS beginframe-contract
+FROM node:22.23.4-bookworm-slim AS beginframe-contract
 
 # ── System dependencies (identical set to the producer's render image) ───────
 RUN apt-get update && apt-get install -y --no-install-recommends \