From 978e4473b5227ee61ad7d17487063eb3284bea36 Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Sat, 4 Apr 2026 22:13:11 +0200 Subject: [PATCH] fix: pin npm upgrade to v10 in backend Dockerfile npm@latest resolves to v11 which has a broken promise-retry dependency on Node 22 Alpine, causing Docker builds to fail. Pin to npm@10 which stays compatible with the Node 22 base image. --- backend/Dockerfile | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/backend/Dockerfile b/backend/Dockerfile index 2405c923..e4ad7745 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -30,8 +30,9 @@ WORKDIR /app # Upgrade all packages to fix security vulnerabilities (OpenSSL, libexpat, BusyBox CVEs) RUN apk upgrade --no-cache -# Upgrade npm to latest to fix tar, minimatch, brace-expansion CVEs in npm's own deps -RUN npm install -g npm@latest +# Upgrade npm to fix tar, minimatch, brace-expansion CVEs in npm's own deps +# Pin to 10.x to stay compatible with Node 22 Alpine (npm 11.x has dependency issues) +RUN npm install -g npm@10 # Install dumb-init for proper signal handling and postgresql-client for database checks RUN apk add --no-cache dumb-init postgresql-client