build(deps): bump node from 24-alpine3.24 to 26-alpine3.24 in /relay

[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps node from 24-alpine3.24 to 26-alpine3.24.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, docker, relay. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[Apolloccrypt]

Closing this deliberately, not as neglect. The Node line here is pinned, and #351 stops Dependabot reopening it.

The pin. #340 set one Node line across four places at once: engines: ">=22 <25" in the root, relay and admin package.json, .nvmrc at 24, node-version: '24' in all seven CI job steps, and node:24-alpine3.24` (by digest) in both Dockerfiles. Its own wording: the range "makes adopting Node 26 a deliberate bump rather than an accident". This PR is that accident, opened within the hour.

Why the green tick did not catch it. Node 26 is the next even line but does not enter Active LTS until late October 2026; Node 24 is the current LTS line. And there is no .npmrc anywhere in this repo, so engine-strict is off and the npm ci inside the image never reads engines. The image builds green on a runtime all three manifests forbid, and only disagrees with itself at runtime.

What replaces it. #351 makes the docker updater for /relay and /admin ignore version-update:semver-major on node, and on node only. The rust builder keeps its majors (#313 was a real break that had to be seen), and node minor/patch, Alpine rebuilds and digest updates keep arriving weekly. Adopting a new LTS line stays a hand bump of the whole grid, with docs/RELEASE.md as the checklist.

Reopen this when Node 26 reaches Active LTS and the grid moves with it.

Extra for this one: Build prod image (drift gate) did go green here, and that is worth being precise about. It proves relay/Dockerfile builds under node 26 including the liboqs/musl chain. It does not boot the image, and it does not compare the runtime against engines. A green drift gate is not agreement between the image and its own manifest.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.