chore: move the Angular train to 21.2.23 and run on Node 24

.github/workflows/deploy.yml

@@ -37,7 +37,7 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version: 22
+          node-version: 24
           cache: npm
 
       - name: Determine version

.github/workflows/release-verification.yml

@@ -46,7 +46,7 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version: 22
+          node-version: 24
           cache: npm
 
       - name: Install dependencies

.github/workflows/tests.yml

@@ -21,7 +21,7 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version: 22
+          node-version: 24
           cache: npm
 
       - name: Install dependencies
@@ -101,7 +101,7 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version: 22
+          node-version: 24
           cache: npm
 
       - name: Install dependencies

.nvmrc

@@ -1 +1 @@
-22
+24

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22
+FROM node:24
 
 WORKDIR /app
 

deploy/render-service/Dockerfile

@@ -1,11 +1,11 @@
 # The headless render service: diagram figures for documents, drawn by the site's
 # own renderer.
 #
-# Built from node:22 plus Chromium rather than from a Playwright image. The
+# Built from node:24 plus Chromium rather than from a Playwright image. The
 # Playwright images carry three browsers and land around 3 GB; this needs one
-# browser, and node:22 is already on the box as the app image's base, so its
+# browser, and node:24 is already on the box as the app image's base, so its
 # layers are shared rather than downloaded again.
-FROM node:22
+FROM node:24
 
 # Where the browser goes.
 #

deploy/render-service/README.md

@@ -41,8 +41,8 @@ shields a namespace's init from its own signals; and signalling the process from
 the host needs root. Take the policy on docker's terms, or confirm it the next
 time the box reboots.
 
-The image is `node:22` plus Chromium, not a Playwright image. The Playwright
-images carry three browsers and land around 3 GB; this needs one, and node:22 is
+The image is `node:24` plus Chromium, not a Playwright image. The Playwright
+images carry three browsers and land around 3 GB; this needs one, and node:24 is
 already here as the app image's base, so the layers are shared. It installs four
 packages rather than the site's whole tree, and reads their versions out of the
 root `package.json` at build time rather than restating them: dependabot only