## Context
Follow-up to #22673, which pinned the base image back to
`node:24.16.0-alpine` to stop the prod flood of `Invalid response body
while trying to fetch …: Premature close` failures on Gmail/Calendar
sync and Cloudflare checks introduced by the 24.17.0 bump (#22529).
The regression is confirmed upstream: 24.17.0's response-queue-poisoning
fix (CVE-2026-48931) attaches a public `'data'` listener on idle
keep-alive sockets in the `http.Agent` pool, which false-triggers
node-fetch@2's premature-close detection whenever a server abruptly
resets a keep-alive socket right after a **complete** response —
standard behavior for Google's front end. Reported the day 24.17.0
shipped (nodejs/node#63989, #64098) and fixed by nodejs/node#64004,
released in **Node 24.18.0 (2026-06-23)**.
## What this PR does
Bumps all four stages to `node:24.18.0-alpine3.23` (digest-pinned).
24.18.0 is the current 24 LTS and contains:
- everything from 24.17.0: OpenSSL 3.5.7, CVE-2026-48930 (CVSS 9.8), and
the response-queue-poisoning guard itself — reimplemented via the
socket's internal `onread` hook instead of a public stream listener
(nodejs/node#64004)
- so we get the full security posture back **and** the regression fix.
## Verification
Deterministic repro (complete chunked response over keep-alive, then
abrupt socket destroy — per nodejs/node#64098), run against all three
images with node-fetch v2 and v3:
| Node | node-fetch@2 | node-fetch@3 |
|------|--------------|--------------|
| 24.16.0 | OK | OK |
| 24.17.0 | **`ERR_STREAM_PREMATURE_CLOSE: Invalid response body …
Premature close`** (byte-for-byte the prod Sentry error) | OK |
| 24.18.0 | OK | OK |
node-fetch@2 is what the Gmail batch layer
(`@jrmdayn/googleapis-batcher`) and the Cloudflare client resolve to,
matching the affected prod paths.
## Related
- #22673 — interim rollback to 24.16.0 (shipped as twenty/v2.19.1); this
PR supersedes it
- #22671 — classifies `ERR_STREAM_PREMATURE_CLOSE` as a transient
retryable network error; still worth landing since servers legitimately
reset keep-alive sockets
<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22677?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
Charles Bochet
89b6037db2
