build: 镜像与 CI 升级到 Node 24 LTS，Caddy 升级到 2.11.4

.github/workflows/check.yml

@@ -22,12 +22,12 @@ jobs:
       NEXT_TELEMETRY_DISABLED: "1"
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: 20.19.2
+          node-version: 24.21.0
 
       - name: Enable pnpm
         run: |
@@ -53,12 +53,12 @@ jobs:
       NEXT_TELEMETRY_DISABLED: "1"
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: 20.19.2
+          node-version: 24.21.0
 
       - name: Enable pnpm
         run: |

.github/workflows/docker.yml

@@ -39,13 +39,13 @@ jobs:
     timeout-minutes: 40
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build API image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: Dockerfile
@@ -56,7 +56,7 @@ jobs:
           cache-to: type=gha,mode=max,scope=ou-image-hosting
 
       - name: Build Web image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: Dockerfile

CHANGELOG.md

@@ -22,6 +22,11 @@
 - 微调品牌标题字体的字距与行高，让首页、登录页和上传页大标题更舒展，不再显得过紧。
 - 修复游客公共上传误出现在管理员“我的上传历史”中的归属隔离问题。
 
+### Changed
+
+- Docker 镜像与 CI 改用 Node.js 24.21.0 LTS（Node.js 20 已于 2026 年 4 月停止维护）；CI 与 Docker 工作流的 GitHub Actions 升级到运行在 Node 24 上的主版本。
+- HTTPS 入口 Caddy 升级至 2.11.4，包含 2.11.x 系列的多项安全修复。
+
 ## [1.0.0] - 2026-07-11
 
 ### Added

Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.7
 
-ARG NODE_VERSION=20.19.2
+ARG NODE_VERSION=24.21.0
 ARG PNPM_VERSION=9.15.9
 
 FROM node:${NODE_VERSION}-bookworm-slim AS toolchain

docker-compose.yml

@@ -102,7 +102,7 @@ services:
     <<: *runtime-defaults
     profiles:
       - https
-    image: caddy:2.10.2-alpine
+    image: caddy:2.11.4-alpine
     env_file:
       - ${OU_ENV_FILE:-.env.production}
     depends_on:

docs/deployment.md

@@ -72,7 +72,7 @@ COMPOSE_PARALLEL_LIMIT=1 docker compose --env-file .env.production build api
 COMPOSE_PARALLEL_LIMIT=1 docker compose --env-file .env.production build web
 ```
 
-The images pin Node.js 20.19.2 and pnpm 9.15.9, install with the frozen lockfile,
+The images pin Node.js 24.21.0 LTS and pnpm 9.15.9, install with the frozen lockfile,
 and run as the unprivileged `node` user.
 
 On CPU-limited hosts, prefer images built by CI. `nice` does not reliably limit