Fix glob CVE-2025-64756 security vulnerability in Docker images

Upgrade npm to latest version in both backend and frontend Dockerfiles
to fix the command injection vulnerability in glob's CLI (CVE-2025-64756).
The vulnerability exists in npm's bundled glob package (< 10.5.0 or < 11.1.0).
This commit is contained in:
Claude
2025-11-27 16:23:08 +00:00
committed by paul
parent a59a4232ff
commit d494eda301
2 changed files with 9 additions and 0 deletions
+3
View File
@@ -12,6 +12,9 @@ LABEL org.opencontainers.image.source="https://github.com/the-luap/picpeak"
LABEL org.opencontainers.image.description="PicPeak Frontend Application"
LABEL org.opencontainers.image.licenses="MIT"
# Upgrade npm to fix glob CVE-2025-64756 vulnerability
RUN npm install -g npm@latest
# Set working directory
WORKDIR /app