fix(deps): update to node.js 20.18.0

[MikeMcC399]

• closes Latest Debian 12.x fixes not deployed #1217

Issue

Concerning

Image	Debian	Published	Version
cypress/base	12.6	Aug 26, 2024	20.17.0
cypress/browsers	12.7	Sep 25, 2024	node-20.17.0-chrome-129.0.6668.70-1-ff-130.0.1-edge-129.0.2792.52-1
cypress/included	12.7	Sep 25, 2024	13.15.0

trivy image --ignore-unfixed --pkg-types os --scanners vuln --severity CRITICAL cypress/base:latest
trivy image --ignore-unfixed --pkg-types os --scanners vuln --severity CRITICAL cypress/browsers:latest
trivy image --ignore-unfixed --pkg-types os --scanners vuln --severity CRITICAL cypress/included:latest

reports critical fixed issues not yet installed, for example with cypress/base:latest:

cypress/base:latest (debian 12.7)

Total: 5 (CRITICAL: 5)

┌───────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────────┬─────────────────────────────────────────────────────────────┐
│  Library  │ Vulnerability  │ Severity │ Status │ Installed Version │   Fixed Version    │                            Title                            │
├───────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────────┼─────────────────────────────────────────────────────────────┤
│ git       │ CVE-2024-32002 │ CRITICAL │ fixed  │ 1:2.39.2-1.1      │ 1:2.39.5-0+deb12u1 │ git: Recursive clones RCE                                   │
│           │                │          │        │                   │                    │ https://avd.aquasec.com/nvd/cve-2024-32002                  │
├───────────┤                │          │        │                   │                    │                                                             │
│ git-man   │                │          │        │                   │                    │                                                             │
│           │                │          │        │                   │                    │                                                             │
├───────────┼────────────────┤          │        ├───────────────────┼────────────────────┼─────────────────────────────────────────────────────────────┤
│ libexpat1 │ CVE-2024-45490 │          │        │ 2.5.0-1           │ 2.5.0-1+deb12u1    │ libexpat: Negative Length Parsing Vulnerability in libexpat │
│           │                │          │        │                   │                    │ https://avd.aquasec.com/nvd/cve-2024-45490                  │
│           ├────────────────┤          │        │                   │                    ├─────────────────────────────────────────────────────────────┤
│           │ CVE-2024-45491 │          │        │                   │                    │ libexpat: Integer Overflow or Wraparound                    │
│           │                │          │        │                   │                    │ https://avd.aquasec.com/nvd/cve-2024-45491                  │
│           ├────────────────┤          │        │                   │                    ├─────────────────────────────────────────────────────────────┤
│           │ CVE-2024-45492 │          │        │                   │                    │ libexpat: integer overflow                                  │
│           │                │          │        │                   │                    │ https://avd.aquasec.com/nvd/cve-2024-45492                  │
└───────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────────┴─────────────────────────────────────────────────────────────┘

Change

In factory/.env, bump environment variables:

• FACTORY_VERSION from 4.2.1 to 4.2.2
• FACTORY_DEFAULT_NODE_VERSION from 20.17.0 to 20.18.0
  (see https://nodejs.org/en/download/releases/)
• CHROME_VERSION from 129.0.6668.70-1 to 129.0.6668.89-1
  (see https://www.ubuntuupdates.org/package/google_chrome/stable/main/base/google-chrome-stable)
• EDGE_VERSION from 129.0.2792.52-1 to 129.0.2792.65-1
  (see https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/)
• FIREFOX_VERSION from 130.0.1 to 131.0
  (see https://download-installer.cdn.mozilla.net/pub/firefox/releases/)

to rebuild all images including latest Debian 12.x published fixes from the Debian repository.

Verify

cd factory
docker compose build factory
trivy image --ignore-unfixed --pkg-types os --scanners vuln --severity CRITICAL cypress/factory
docker compose build base
trivy image --ignore-unfixed --pkg-types os --scanners vuln --severity CRITICAL cypress/base
docker compose build browsers
trivy image --ignore-unfixed --pkg-types os --scanners vuln --severity CRITICAL cypress/browsers
docker compose build included
trivy image --ignore-unfixed --pkg-types os --scanners vuln --severity CRITICAL cypress/included:latest

should show for each image variant that there are no longer any (critical) vulnerabilities:

Total: 0 (CRITICAL: 0)

[cypress-app-bot]

• Create a Draft Pull Request if your PR is not ready for review. Mark the PR as Ready for Review when you're ready for a Cypress team member to review the PR.