Update dependencies and align Docker runtime

[dex-the-ai]

Summary

• Update couchbase 4.7.0 -> 4.7.1 (kept as an exact pin), express 4.22.1 -> 4.22.2, and prettier 3.8.3 -> 3.9.4
• Regenerate package-lock.json on Node 20.20.2 and let npm audit fix lift the remaining supportable transitive packages inside the current dependency ranges
• Keep both the Docker runtime and the GitHub Actions runtime on Node 20 after the maintainer follow-up review

Verification

• npm install (Node 20.20.2)
• npm test
• npm audit
• ./node_modules/.bin/babel-node src/server
• curl -i http://127.0.0.1:3013/
• curl http://127.0.0.1:3013/api/v1/airline/airline_10
• Dockerized Playwright walkthrough on http://127.0.0.1:3003/

Evidence

• npm test passed 19/19 suites against Capella + travel-sample on Node 20.20.2 using the local config/test.env.
• npm audit now reports found 0 vulnerabilities without needing an Express 5 jump.
• The live app started successfully on Node 20.20.2 and served both the Swagger root and a real airline document from GET /api/v1/airline/airline_10.
• Visual proof from the running app:
  • tutorial-maintenance/runs/couchbase-examples__nodejs-quickstart/2026-06-30T1455Z/screenshots/swagger-ui-home.png
  • tutorial-maintenance/runs/couchbase-examples__nodejs-quickstart/2026-06-30T1455Z/video/swagger-ui-walkthrough.webm
• Supporting local notes: tutorial-maintenance/runs/couchbase-examples__nodejs-quickstart/2026-06-30T1455Z/verification.md

Additional notes

• Maintainer follow-up on June 30, 2026 requested leaving both Docker and GitHub Actions on Node 20, so this PR now keeps those runtime surfaces at 20 while still taking the dependency updates.
• docker build is still blocked on this ARM64 host because the repo intentionally pins FROM --platform=linux/amd64 ..., and the local daemon does not have the needed amd64 emulation (exec format error). I kept that as a documented environment blocker instead of changing the repo’s platform target spec.

Notes

• I kept this pass to patch/minor updates and lockfile hygiene rather than expanding scope into Express 5.
• No README/tutorial drift needed a docs edit in this sweep.

Media evidence

• Auto-attached reviewer-facing media from the local verification artifacts captured during this run.
• This keeps the main PR body self-contained instead of relying on a follow-up comment for visual proof.

Notes

• Local artifact path: tutorial-maintenance/runs/couchbase-examples__nodejs-quickstart/2026-06-30T1455Z/screenshots/swagger-ui-home.png

Swagger Ui Walkthrough

Notes

• Local artifact path: tutorial-maintenance/runs/couchbase-examples__nodejs-quickstart/2026-06-30T1455Z/video/swagger-ui-walkthrough.webm

[dex-the-ai]

Owner ping for this maintenance PR: @ejscribner @prajwal-pai77

Requesting review from the manifest-listed owner(s) where GitHub does not already show a pending review request.

[gemini-code-assist]

Code Review

This pull request updates the Node.js base image in the Dockerfile from version 20 to 24 and upgrades several dependencies in package.json, including couchbase, express, and prettier. Feedback on these changes suggests using a minimal node:24-slim base image to reduce container size and security risks, as well as pinning the exact version of the couchbase native module to prevent ABI compatibility issues and ensure reproducible builds.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.