Dependency hygiene: pin Dockerfile base images by digest + npm audit fix#72
Closed
ibuilder wants to merge 2 commits into
Closed
Dependency hygiene: pin Dockerfile base images by digest + npm audit fix#72ibuilder wants to merge 2 commits into
ibuilder wants to merge 2 commits into
Conversation
Pin every FROM line in the API, web, and converter Dockerfiles to the exact current multi-platform @sha256 index digest instead of mutable tags, for supply-chain integrity. Digests resolved from the Docker Hub registry (OCI image index, equivalent to buildx imagetools inspect): node:20-slim sha256:2cf067cf...febfc0 python:3.12-slim sha256:57cd7c3a...710de nginx:alpine sha256:4a73073b...c1752 Add a docker ecosystem to Dependabot (per-Dockerfile directory) so these digests auto-bump weekly. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Resolve the high-severity fast-uri advisories (GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6) pulled in transitively via vite-plugin-pwa -> workbox-build -> ajv -> fast-uri. `npm audit fix` bumps the nested fast-uri to 3.1.4. Lock regenerated with npm's nested install strategy (npm install --package-lock-only --install-strategy=nested) to keep the tree correct; package.json is unchanged. Deferred: the nested js-yaml (GHSA-52cp-r559-cp3m) via @redocly/openapi-core is NOT fixable without a breaking major. The fix lives in @redocly/openapi-core 2.x, but openapi-typescript@7.13.0 (the latest release) pins @redocly/openapi-core ^1.34.6, whose newest 1.x (1.34.17) hard-pins js-yaml 4.2.0. Left per spec (no breaking bumps). npm audit --omit=dev stays at 0 vulnerabilities. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
ibuilder
added a commit
that referenced
this pull request
Jul 23, 2026
ibuilder
added a commit
that referenced
this pull request
Jul 23, 2026
Owner
Author
|
Landed in v0.3.586 (merged into main with the full suite re-verified — 313/313 green). Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tier-1 follow-up to the production/enterprise audit. Dependency-only (no application source). Extends PR #69's supply-chain work to the Dockerfile
FROMlines and fixes a dev-only npm advisory.1. Pin Dockerfile base images by digest (SEC F4)
services/api/Dockerfile,apps/web/Dockerfile,services/converter/Dockerfile,.github/dependabot.ymlFROMlines pinned by@sha256:digest instead of mutable tags (node:20-slim, python:3.12-slim, nginx:alpine). Digests resolved via the Docker Hub registry API and verified as multi-platform OCI indexes (docker/buildx unavailable in the sandbox).package-ecosystem: dockerDependabot entries (one per Dockerfile directory) so digests auto-bump weekly. YAML validated.2. npm audit fix — dev/docs chain (SEC F6)
apps/web/package.json+ rootpackage-lock.jsonfast-uri3.1.2 → 3.1.4 (GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6, viavite-plugin-pwa → workbox-build → ajv → fast-uri). Lock regenerated with--install-strategy=nested.js-yaml/@redocly/openapi-core— the fix ships in redocly 2.x, butopenapi-typescript@7.13.0caps redocly at<2.0.0(1.34.17 hard-pins js-yaml 4.2.0). Unfixable without a breaking major; left per the spec.npm audit3 high → 2 high (deferred pair, both dev-only).npm audit --omit=devstays 0.Validations
npm run typecheck -w apps/web✅,npm run build -w apps/web(PWA/workbox,dist/sw.js) ✅,openapi-typescriptcodegen ✅, 121 tests pass ✅.maintarget; PR chore(deps): runtime & dependency upgrade stack — Node 22, Vite 8, Capacitor 8, Postgres 17 #69's Node 22 bump is unmerged).```task
file:services/api/Dockerfile
file:apps/web/Dockerfile
file:services/converter/Dockerfile
file:.github/dependabot.yml
file:apps/web/package.json
file:package-lock.json
```