build(deps): bump node from 24-slim to 25-slim in /services/converter

[dependabot]

Bumps node from 24-slim to 25-slim.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

So far, Strix has reviewed 28 pull requests, surfaced 3 security issues (1 critical/high) and blocked 2 risky merges across this workspace.

[ibuilder]

Closing — this bump moves the converter off an LTS base and onto one that is already end-of-life,
and it has been tried here before.

Verified against the Node release schedule today (2026-08-28), not from memory:

major	LTS	end of life	status
24	yes, since 2025-10-28	2028-04-30	supported (current pin)
25	never	2026-06-01	EOL — three months ago
26	becomes LTS 2026-10-28	2029-04-30	not yet LTS

Node 25 is an odd-numbered "Current" release; it never became LTS and stopped receiving security
patches on 2026-06-01. Moving to it means the converter image stops getting base security updates,
which is the opposite of what this dependabot lane exists to do.

This is also a repeat. services/converter/Dockerfile records the history in its own header:

The previous pin here was node:25-slim, an EOL major with no security patches: #117 and #116 raised
both converter images together, the api one was reverted to 24 four days later for that reason, and
this file was not.

And the pin is a product-wide invariant, not a per-file choice — all three Dockerfiles carry the
identical digest today:

services/converter/Dockerfile   FROM node:24-slim@sha256:a9f5f7c9…
services/api/Dockerfile         FROM node:24-slim@sha256:a9f5f7c9…  AS converter
apps/web/Dockerfile             FROM node:24-slim@sha256:a9f5f7c9…  AS build

Merging this would break "one Node runtime across the product" as well as the support window.

What we do want from this lane is unchanged: keep bumping the @sha256 digest on node:24-slim.
That is the mechanism the header calls "the right answer" over accumulating --only-upgrade lines,
and the last such re-pin cleared two CRITICALs with a clean Trivy scan. Digest updates are welcome;
major tag jumps to a non-LTS line are not.

The natural next move is Node 26 once it reaches LTS on 2026-10-28, and it should be raised across
all three Dockerfiles together so the shared digest stays shared.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.