[jdogresorg]

Patch train v0.23.3 (release-management section 7, maintenance line), branch hotfix/v0.23.3 from the v0.23.0 tag, merging into release/v0.23.3 (cut at the v0.23.0 tag commit). This release line is what mainnet runs; master carries v0.26.x.

Change, base image only:

• The runtime stage moves from node:25.9.0 to node:22.23.4-bookworm and the dependency stage from node:22-alpine to node:22.23.4-alpine, both pinned by digest. Node 22.23.4 carries the fix for CVE-2026-111497 (Brotli decoder out-of-bounds write); Node 25 receives no fix. engines is >=22, the dependency stage already ran Node 22, the image holds no native addon, and the full bookworm image keeps wget for the compose healthcheck.

Release commit: chore(release): v0.23.3 (package.json, package-lock.json, CHANGELOG.md). Built from v0.23.0, so no later decoder change is included.

Evidence: unit suite 1975 passing, 0 failing on Node 22.23.4 with every sibling at its v0.23.3 or v0.23.0 tree; the built image reports v22.23.4 on Debian 12 and refuses to start without DECODER_API_PORT, naming the variable. No state-derivation change, so no activation height.

[jdogresorg]

Full test suite green at this PR head a4612bc: CI_TIER=full npm run ci:full inside the shipping image (node v22.23.4), with every train sibling at its v0.23.0 release: 4454 passing, 0 failing, 34 pending (designed skips). The same result holds with the other hotfix repos at their v0.23.0 tags. The red npm audit check reflects advisories already present in the v0.23.0 lockfile (axios, follow-redirects, ip-address, proxy-addr, mariadb); they are tracked for a v0.23.4 dependency hotfix and are not introduced by this change.