From 08be2b84f18073b63fa131c692c50b6df849a0ca Mon Sep 17 00:00:00 2001 From: Paul Nothaft <53005142+the-luap@users.noreply.github.com> Date: Mon, 27 Jul 2026 09:54:33 +0200 Subject: [PATCH] =?UTF-8?q?fix(security):=20close=205=20Trivy=20alerts=20?= =?UTF-8?q?=E2=80=94=20postcss/tar=20bumps=20+=20drop=20npm=20from=20the?= =?UTF-8?q?=20runtime=20image=20(#878)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(security): close the 5 open Trivy alerts — dep bumps + drop npm from the runtime image Backend deps: - postcss 8.5.10 -> 8.5.18 (CVE-2026-45623, GHSA-r28c-9q8g-f849; the pin exists to force sanitize-html's transitive copy onto a fixed version) - tar pin/override >=7.5.16 -> >=7.5.21, resolves 7.5.22 (GHSA-r292-9mhp-454m) Runtime image: - Remove the npm CLI from the final stage instead of upgrading it: npm's bundled node_modules ship tar 7.5.19 and brace-expansion 5.0.7 (no npm release bundles the fixed versions — checked 11.18.0 and 12.0.1), and npm never runs in production. wait-for-db.sh now invokes the migration runners via node directly. This ends the recurring npm-bundled-CVE alert class; the previous 'npm install -g npm@11' line was itself a patch for the last batch. * fix(restore): run post-restore migrations via node — the image ships no npm restoreService still shelled out to 'npm run migrate:safe' after a restore; with npm removed from the runtime image that would ENOENT into the non-fatal catch, silently leaving a restored older backup on a schema behind the running code until the next container restart. Invoke migrations/run-migrations-safe.js through node directly, matching wait-for-db.sh. The PR #596 source-contract test now pins the new invocation. --- backend/Dockerfile | 18 ++++++------ .../restoreService.pgBranch.test.js | 12 ++++---- backend/package-lock.json | 28 +++++++++---------- backend/package.json | 6 ++-- backend/src/services/restoreService.js | 5 +++- backend/wait-for-db.sh | 8 ++++-- 6 files changed, 43 insertions(+), 34 deletions(-) diff --git a/backend/Dockerfile b/backend/Dockerfile index 2f595aac..406aaedd 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -37,14 +37,16 @@ ARG CACHEBUST=1 # Upgrade all packages to fix security vulnerabilities (OpenSSL, libexpat, BusyBox CVEs) RUN echo "cachebust=${CACHEBUST}" && apk upgrade --no-cache -# Upgrade the npm CLI in the final image so its bundled deps are patched -# (sigstore 4.x, tar) — closes CVE-2026-48815 and the older @sigstore/core / tar -# Trivy alerts. Safe here: only the CLI present in the image changes. Runtime -# dependencies come from the builder stage (COPY --from=builder node_modules -# below) and the entrypoint runs node, not npm — so npm 11's install behaviour -# (the reason 10.x was pinned) never executes in this stage. npm 11 needs -# Node >=22.9, satisfied by node:22-alpine. -RUN npm install -g npm@11 +# Remove the npm CLI from the final image. Nothing runs npm here: the +# entrypoint is node, runtime deps are COPY'd from the builder stage, and +# wait-for-db.sh invokes the migration runners via node directly. npm's +# bundled node_modules kept tripping Trivy (sigstore, tar 7.5.19, +# brace-expansion 5.0.7 — even npm 12.0.1 still ships the vulnerable +# copies), so shipping no npm ends that alert class instead of chasing +# per-release patches. Note: `docker exec … npm run