Run docker build with --no-cache for nodejs:16 to always get latest security updates into the image. For travis builds this is not required (travis vm is always empty). But local builds usually use the cache to speed up the build. They would not get the updates unless the Dockerfile is changed somewhere before the update/upgrade or the docker cache is cleared.