🔒 security(docker): bump node and trivy base-image digests by scttbnsn · Pull Request #682 · CodesWhat/drydock

scttbnsn · 2026-08-08T23:40:39Z

Summary

Bumps the pinned node and trivy base-image digests in the Dockerfile to the current upstream releases, clearing the open base-image CVEs ahead of the v1.6.0-rc.13 cut. Held since 2026-08-04 for the GA window; promoted to rc.13 content now that the release plan cuts a final candidate instead of promoting rc.12.

Digest assertions in app/configuration/dockerfile-defaults.test.ts updated to match the pins.

Testing

Full pre-push gate green at push time (coverage 100% app+ui, builds, e2e, playwright)
Trivy scan against the rebuilt image: no HIGH/CRITICAL findings

Changelog

🔒 Security: Updated pinned Node 24 Alpine and Trivy image digests.
🔧 Changed: Updated Node from 24.18.0 to 24.19.0.
🔧 Changed: Updated Trivy from 0.72.0 to 0.73.0.
🔧 Changed: Updated digest assertions in app/configuration/dockerfile-defaults.test.ts.
🔒 Security: Rebuilt image scan reported no HIGH or CRITICAL findings.

Concerns

Confirm the full pre-push gate remains passed.
Confirm the release-stage Docker build validates node --version and trivy --version.

Both were resolved from the live Docker Hub registry (buildx imagetools inspect + registry API cross-check), not guessed, and the resulting image was verified with `node --version` / `trivy --version` inside a built container plus a full `docker build` of the release stage. - node:24-alpine: 24.18.0 -> 24.19.0, picking up Node's July 29 2026 security release (3 HIGH + 5 MEDIUM CVEs fixed in 24.18.1) sha256:a0b9bf06... -> sha256:d32cdf619f... - aquasec/trivy (trivy-bin build stage): 0.72.0 -> 0.73.0, resolving 4 HIGH / 6 MEDIUM CVEs in vendored Go deps (go-git, x/text, grpc, oras-go, stdlib) sha256:cffe3f5161... -> sha256:7cced7cae5...

vercel · 2026-08-08T23:40:45Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
drydock-website	Ready	Preview	Aug 9, 2026 12:37am
drydockdemo-website	Ready	Preview	Aug 9, 2026 12:37am

coderabbitai · 2026-08-08T23:40:50Z

Warning

Review limit reached

@scttbnsn, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 40 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5f481d63-84cd-4d70-9a0d-8ce559b33fef

📥 Commits

Reviewing files that changed from the base of the PR and between e911c22 and 8a79117.

📒 Files selected for processing (1)

app/configuration/dockerfile-defaults.test.ts

📝 Walkthrough

Walkthrough

The Dockerfile now uses updated pinned digests for the Trivy image and Node 24 Alpine base image. The Dockerfile test now expects the updated Trivy digest. Stage names and image tags remain unchanged.

Possibly related PRs

CodesWhat/drydock#680: Directly duplicates the Dockerfile and matching test digest updates.
CodesWhat/drydock#523: Updates pinned Docker image or package versions with related Dockerfile test changes.
CodesWhat/drydock#533: Updates Docker image pins and corresponding Dockerfile-default test expectations.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/v1.6-base-image-cves

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

scttbnsn · 2026-08-09T00:25:26Z

@coderabbitai review

coderabbitai · 2026-08-09T00:25:31Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai

🧹 Nitpick comments (1)

app/configuration/dockerfile-defaults.test.ts (1)
14-14: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Cover the updated Node digest in this test.

Dockerfile Line 7 changes the pinned Node digest, but this test only asserts the Trivy digest. Add an exact assertion for the Node FROM line so future Node pin drift fails the test.
Proposed test addition
     expect(dockerfile).toContain(
       'FROM aquasec/trivy@sha256:7cced7cae583819fc7806d4cbc0dbbc7cad18b99f7d3e235192e6da8c091045c AS trivy-bin',
     );
+    expect(dockerfile).toContain(
+      'FROM node:24-alpine@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS base',
+    );
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/configuration/dockerfile-defaults.test.ts` at line 14, Update the test
covering Dockerfile image pins to assert the exact Node FROM line and its
updated digest, alongside the existing Trivy assertion. Use the test’s current
Dockerfile-content assertion mechanism so future Node digest changes cause the
test to fail.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@app/configuration/dockerfile-defaults.test.ts`:
- Line 14: Update the test covering Dockerfile image pins to assert the exact
Node FROM line and its updated digest, alongside the existing Trivy assertion.
Use the test’s current Dockerfile-content assertion mechanism so future Node
digest changes cause the test to fail.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5ce3f270-5372-4192-9a76-10f53d9b7be1

📥 Commits

Reviewing files that changed from the base of the PR and between 9e4e56c and e911c22.

⛔ Files ignored due to path filters (1)

CHANGELOG.md is excluded by !CHANGELOG.md

📒 Files selected for processing (2)

Dockerfile
app/configuration/dockerfile-defaults.test.ts

…e defaults

scttbnsn · 2026-08-09T00:35:51Z

Nitpick addressed in 8a79117 — added the Node digest assertion as its own test case alongside the Trivy one.

biggest-littlest

LGTM

17-file identity roll-forward from rc.12 to rc.13, dated 2026-08-08. - CHANGELOG: new `[1.6.0-rc.13]` section from Unreleased content — #670 digest re-anchoring, #672 self-hosted Star History, #673 nanoid pin, #682 node 24.19.0 + trivy 0.73.0 base-image bumps, #683 icon-bundle alias resolution — plus compare-link rotation - README: version badge + rc.13 highlights block - Demo mocks, site config/content, docs API pages, quickstart, updates highlights, identity-test constants, changelog-link pairs Guarded by `scripts/release-identity.test.mjs` (4/4) and the web scripts suite (56/56). Once merged: dev→main wholesale-tree sync, then dispatch `release-cut.yml` for `v1.6.0-rc.13`. GA candidate clock restarts — earliest GA ≈ Aug 16.  ## Changelog 🔧 **Changed** - Advanced the release identity from `1.6.0-rc.12` to `1.6.0-rc.13`, dated August 8, 2026. - Updated README, demo mocks, site configuration, roadmap content, API examples, quickstart, and update highlights. - Updated changelog comparison links and release identity test constants. - Added release notes for digest re-anchoring, self-hosted Star History, `nanoid` pins, Node 24.19.0 and Trivy 0.73.0 base images, and icon-bundle alias resolution. 🔒 **Security** - Documented workspace-wide `nanoid` security pinning. - Documented base-image CVE remediation. ## Concerns - Sync the `dev` tree to `main` after merge. - Dispatch `release-cut.yml` for `v1.6.0-rc.13`. - Confirm the expected GA date remains approximately August 16.

Wholesale-tree sync ahead of the v1.6.0-rc.13 cut (same pattern as #667). The single commit carries the exact tree of `dev/v1.6` at b98808e onto `main` — after merge, `git diff --quiet origin/main origin/dev/v1.6` holds. Content on dev since rc.12: - #669/#670 — release-cut digest re-anchoring - #672 — self-hosted Star History chart - #673 — NAS acceptance follow-ups - #681 — v1.7 dependency ordering (forward-ported) - #682 — CVE base-image bumps + digest-pinned Node base guard test - #683 — icon-bundle alias resolution (fixes blank Audit/registry icons shipped in rc.12) - #684 — rc.13 identity roll-forward (17 files, CHANGELOG, README)  ## Changelog - ✨ Added repository-aware Docker digest selection and multi-anchor comparison. - ✨ Added self-hosted, theme-aware Star History SVG API with pagination, caching, deadlines, and fallback rendering. - ✨ Added icon alias resolution and bundle coverage tests. - ✨ Added required icon bundle entries and updated icon mappings. - 🔧 Updated Node and Trivy image digests. - 🔒 Pinned `nanoid` to `3.3.18` across workspaces. - 🔒 Added a digest-pinned Node 24 Alpine base-image guard test. - 🔧 Updated `js-yaml` override to `3.15.1`. - 🔧 Updated release documentation, examples, mocks, badges, and tests to `1.6.0-rc.13`. - 🔧 Removed the external Star History CSP allowlist and embed. ## Concerns - Verify the Star History route stays within GitHub API rate limits under concurrent requests. - Verify cache headers do not serve incomplete or repository-specific fallback responses incorrectly. - Verify Docker digest re-anchoring preserves legacy behavior for stored containers without `repoDigests`. - Verify icon aliases with rotation or flipping have acceptable fallback behavior. - Run the Docker, Star History, icon-bundle, release-identity, and workspace dependency tests.

scttbnsn requested review from ALARGECOMPANY and biggest-littlest as code owners August 8, 2026 23:40

coderabbitai Bot reviewed Aug 9, 2026

View reviewed changes

✅ test(config): assert the digest-pinned node base image in dockerfil…

8a79117

…e defaults

biggest-littlest approved these changes Aug 9, 2026

View reviewed changes

vercel Bot deployed to Preview – drydock-website August 9, 2026 00:37 View deployment

vercel Bot deployed to Preview – drydockdemo-website August 9, 2026 00:37 View deployment

scttbnsn merged commit bd6f598 into dev/v1.6 Aug 9, 2026
26 checks passed

scttbnsn deleted the fix/v1.6-base-image-cves branch August 9, 2026 01:02

scttbnsn mentioned this pull request Aug 9, 2026

🔧 chore(release): roll release identity forward to v1.6.0-rc.13 #684

Merged

scttbnsn mentioned this pull request Aug 9, 2026

🚀 release: sync dev/v1.6 → main for v1.6.0-rc.13 #685

Merged

Navigation Menu

Uh oh!

Uh oh!

🔒 security(docker): bump node and trivy base-image digests - #682

🔒 security(docker): bump node and trivy base-image digests#682
scttbnsn merged 2 commits into
dev/v1.6from
fix/v1.6-base-image-cves

scttbnsn commented Aug 8, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Aug 8, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 8, 2026 •

edited

Loading

Review limit reached

Walkthrough

Uh oh!

scttbnsn commented Aug 9, 2026

Uh oh!

coderabbitai Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

scttbnsn commented Aug 9, 2026

Uh oh!

biggest-littlest left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

scttbnsn commented Aug 8, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Changelog

Concerns

Uh oh!

vercel Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Uh oh!

scttbnsn commented Aug 9, 2026

Uh oh!

coderabbitai Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

scttbnsn commented Aug 9, 2026

Uh oh!

biggest-littlest left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

scttbnsn commented Aug 8, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented Aug 8, 2026 •

edited

Loading

coderabbitai Bot commented Aug 8, 2026 •

edited

Loading

coderabbitai Bot commented Aug 9, 2026 •

edited

Loading