🔒 security: v1.7 hygiene — icon integrity, base-image CVE bumps, dead SW rule - #680
Conversation
PR #668's icon-bundle regeneration against tabler 1.2.38 dropped lucide:history because @iconify-json/lucide 1.2.121 no longer ships a history glyph, leaving iconMap.audit.lucide pointing at a key the bundle didn't have — a blank Audit nav icon for the Lucide preference. - Repoint iconMap.audit.lucide to lucide:rotate-ccw-clock (same clock-with-counterclockwise-arrow concept as fa6-solid:clock-rotate-left / ph:clock-counter-clockwise already used for this entry) - Fix the same class of stale reference found by re-running the extraction script: iconoir:history -> iconoir:clock-rotate-right, lucide:more-vertical -> lucide:ellipsis-vertical, iconoir:key-alt -> iconoir:key, iconoir:gitlab -> iconoir:gitlab-full, iconoir:stack -> iconoir:cube (all renamed upstream in the installed iconsets) - Add @iconify-json/fa6-brands 1.2.4 as a devDependency — it was referenced by icons.ts (github/gitlab/google/microsoft brand icons under the fa6-solid preference) but never installed, so those four icons were silently missing from every bundle regeneration - Regenerate ui/src/boot/icon-bundle.json (all 576 icon references now resolve, zero warnings from scripts/extract-icons.mjs) - Add ui/tests/icons.spec.ts asserting every iconMap entry has a matching icon-bundle.json key, so this class of regression fails tests instead of shipping a blank icon
Atomic changelog entry for the icon-bundle fix committed in 73380f5d.
Both were resolved from the live Docker Hub registry (buildx imagetools inspect + registry API cross-check), not guessed, and the resulting image was verified with `node --version` / `trivy --version` inside a built container plus a full `docker build` of the release stage. - node:24-alpine: 24.18.0 -> 24.19.0, picking up Node's July 29 2026 security release (3 HIGH + 5 MEDIUM CVEs fixed in 24.18.1) sha256:a0b9bf06... -> sha256:d32cdf619f... - aquasec/trivy (trivy-bin build stage): 0.72.0 -> 0.73.0, resolving 4 HIGH / 6 MEDIUM CVEs in vendored Go deps (go-git, x/text, grpc, oras-go, stdlib) sha256:cffe3f5161... -> sha256:7cced7cae5...
Adds root .trivyignore.yaml (trivy's documented misconfiguration ignore format) suppressing AVD-DS-0002/DS-0002 (Dockerfile missing USER) for the same reason the Dockerfile already carries a checkov:skip=CKV_DOCKER_3 comment and .qlty/qlty.toml already has a [[triage]] rule for trivy:DS002/DS-0002: Docker.entrypoint.sh drops privileges at runtime via su-exec, so a static USER instruction isn't needed. Unlike the qlty triage rule (only honored when trivy runs through qlty's plugin wrapper), .trivyignore.yaml is trivy's own native suppression mechanism, so it also covers a bare `trivy config` invocation run directly against the Dockerfile. Verified against the newly-pinned aquasec/trivy@sha256:7cced7cae5... (0.73.0, see cd3b3e3e): `trivy config Dockerfile` reports 1 HIGH (DS-0002) without the ignorefile and 0 misconfigurations with it.
workbox-routing tests a RegExpRoute's urlPattern against the full url.href
(always starting http://https://), never against the pathname alone, so
the ^-anchored /^\/api\// regex in ui/vite.config.ts's runtimeCaching
entry could never match and silently fell through. Harmless today only
because no other runtimeCaching rule exists to catch the fallthrough -
any future catch-all rule would have started caching authenticated /api
responses. Replaced with an exported isApiRequest match-callback that
tests url.pathname.startsWith('/api/') so the rule actually engages, and
covered it with direct unit tests.
|
@coderabbitai review |
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 17 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe PR updates pinned Trivy and Node 24 Alpine image digests and adds a scoped Trivy suppression. It refreshes UI icon dependencies, bundled definitions, and icon mappings. It adds icon bundle consistency coverage. It exports Possibly related PRs
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Around line 4-7: Update the image-scanning workflow configuration in
security-grype.yml so pull requests targeting dev/v1.7 and changes to Dockerfile
trigger the required scan, while preserving existing main-branch and
package-manifest filters.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 0413b945-dd69-4617-9324-f8e11910f4e1
⛔ Files ignored due to path filters (2)
CHANGELOG.mdis excluded by!CHANGELOG.mdui/package-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.json
📒 Files selected for processing (9)
.trivyignore.yamlDockerfileapp/configuration/dockerfile-defaults.test.tsui/package.jsonui/src/boot/icon-bundle.jsonui/src/icons.tsui/tests/config/vite.config.spec.tsui/tests/icons.spec.tsui/vite.config.ts
) (#686) Forward-ports #683 to dev/v1.7. #680 fixed the symptom here (direct icon-name renames) but not the root cause: `ui/scripts/extract-icons.mjs` still dropped icons that iconify collections demote to aliases (`collection.aliases[name].parent`), so any future collection bump could silently ship broken icons again — that's exactly how rc.12 shipped a blank Audit icon. What's in the port: - `extract-icons.mjs`: `resolveIcon()` follows alias parent chains (depth-capped), merges alias overrides, refuses transform-requiring aliases with a warning. - `ui/tests/boot/icon-bundle.spec.ts`: guard test — every `prefix:name` ref in `icons.ts` must exist in the bundle with a body. - `iconoir:stack` → `multiple-pages` (#680 had picked `cube`; `multiple-pages` matches v1.6 and verified valid against locked iconoir 1.2.11). - `@iconify-json/fa6-brands` 1.2.4 → 1.2.6 exact-pinned (devDependencies). - Bundle regenerated: 576/576 refs, zero warnings, 229.8 KB; `npm run build` leaves the tree clean. 4508 UI tests, 100% coverage, full pre-push gate green. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Changelog - ✨ Added recursive Iconify alias resolution with parent-chain traversal, override merging, depth limits, and transform warnings. - ✨ Added a guard test for missing or empty icon bundle entries. - 🔧 Replaced `iconoir:cube` with `iconoir:multiple-pages` for the `stack` icon. - 🔧 Pinned `@iconify-json/fa6-brands` to `1.2.6`. - 🐛 Fixed extraction of indirect icon aliases. ## Concerns - Verify aliases with rotation or flipping produce actionable warnings and do not enter the body-only bundle. - Keep the guard test aligned with all supported `icons.ts` reference formats. - Confirm the regenerated bundle contains all 576 references with nonempty bodies. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2 participants
Security/correctness hygiene batch from the 2026-08-08 sweep workflows.
Icon-bundle integrity
lucide:historywas dropped by tabler/lucide bundle regeneration in 🗑️ remove(triggers): drop DD_TRIGGER_* legacy aliases (Phase 4 removal) #674) and fixes 5 more stale icon references (iconoir history/key/gitlab/stack, lucide more-vertical)@iconify-json/fa6-brandsdevDep that the bundle referenced but never declaredui/tests/icons.spec.ts: everyiconMapkey must resolve against the generatedicon-bundle.json, so future bundle regenerations can't silently blank iconsBase image CVEs
node:24-alpinedigest → Node 24.19.0 (fixes CVE-2026-56846 / CVE-2026-56848 / CVE-2026-58043 HIGH + 5 MEDIUM in the 24.18.0 runtime binary)aquasec/trivydigest → 0.73.0 (clears go-git CVE-2026-71556, x/text CVE-2026-56852, grpc GHSA-hrxh-6v49-42gf, oras-go CVE-2026-50151/50163, stdlib CVE-2026-39822 in the vendored CLI).trivyignore.yamlfor AVD-DS-0002: the no-USER-directive finding is mitigated by design (su-exec runtime privilege drop); trivy can't honor inline skips for absence-of-resource checksDead service-worker rule
runtimeCachingNetworkOnly rule for/api/**never matched: workbox's RegExpRoute tests the fullurl.href, so the^\/api\//anchor can never hit. Replaced with an exportedisApiRequestpathname matcher + tests. Currently masked (no other caching rules), but any future catch-all rule would have silently cached authenticated API responses.All commits gate-green (biome, qlty, 100% coverage app+ui, build, e2e, playwright, zizmor).
Changelog
AVD-DS-0002Trivy suppression forsu-exec.mainanddev/**.@iconify-json/fa6-brands.icon-bundle.json.iconMapbundle-integrity tests./api/**rule with the exportedisApiRequestpathname matcher.Concerns
AVD-DS-0002suppression remains valid if the Docker entrypoint or privilege model changes./api/when they do not start with/api/is intentional.