Claude
14c4bc17f3
- CVE-2025-64756: glob CLI command injection - added override to use glob ^11.1.0 - CVE-2025-13466: body-parser DoS - added override to use body-parser ^2.2.1 - CVE-2025-64718: js-yaml prototype pollution - updated to js-yaml ^4.1.1 - BusyBox vulnerabilities (netstat, tar) - added apk upgrade to all Dockerfiles Changes: - backend/package.json: Updated js-yaml, added overrides for glob, body-parser - frontend/package.json: Added overrides for glob, js-yaml - All Dockerfiles: Added 'apk upgrade --no-cache' to get latest security patches - backend/Dockerfile.dev: Updated from node:18-alpine to node:20-alpine
32 lines
671 B
Docker
32 lines
671 B
Docker
FROM node:20-alpine
|
|
|
|
WORKDIR /app
|
|
|
|
# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
|
|
RUN apk upgrade --no-cache
|
|
|
|
# Install dumb-init for proper signal handling
|
|
RUN apk add --no-cache dumb-init
|
|
|
|
# Copy package files
|
|
COPY package*.json ./
|
|
|
|
# Install all dependencies (including dev)
|
|
RUN npm install
|
|
|
|
# Copy application files
|
|
COPY . .
|
|
|
|
# Create necessary directories
|
|
RUN mkdir -p storage/events/active storage/events/archived storage/thumbnails data logs
|
|
|
|
# Create non-root user
|
|
RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
|
|
RUN chown -R nodejs:nodejs /app
|
|
|
|
USER nodejs
|
|
|
|
EXPOSE 3000
|
|
|
|
ENTRYPOINT ["dumb-init", "--"]
|
|
CMD ["npm", "run", "dev"] |