@5247d105-9851-54b4-9e20-2475e9f7238b/ruby
Watch
1
0
Fork
You've already forked ruby
 0
Code W3DS Deploy Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions

fix(docker): clear GitW3 vulnerability scan (5 critical, 72 high) #1

Merged
Andrei Puchkov merged 1 commit from fix/vuln-scan-main into main 2026-10-28 12:46:26 +00:00
Conversation 0 Commits 1 Files changed 4 +336 -1028
Andrei Puchkov commented 2026-10-28 12:46:21 +00:00
Owner
Copy link

The production image shipped three sources of known CVEs:

  • the API's full node_modules, devDependencies included (jest, ts-jest,
    nodemon: handlebars, js-yaml, browserslist...) -> npm prune --omit=dev
  • runtime deps locked at vulnerable versions (axios, express/proxy-addr,
    body-parser, follow-redirects, form-data, ip-address, minimatch,
    brace-expansion) -> lockfile refreshed within the existing ranges
  • sqlite3 5 in the vendored web3-adapter, which pulls tar 6 via node-gyp 8
    -> sqlite3 ^6.0.1 (tar 7)
  • the EOL node:20-alpine base, its outdated OpenSSL and bundled npm/yarn
    -> node:24-alpine, apk upgrade, npm/yarn/corepack removed from runtime

Trivy 0.58.1 (HIGH,CRITICAL): 5 critical / 72 high -> 0 / 0.
Also adds a .dockerignore.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

The production image shipped three sources of known CVEs: - the API's full node_modules, devDependencies included (jest, ts-jest, nodemon: handlebars, js-yaml, browserslist...) -> npm prune --omit=dev - runtime deps locked at vulnerable versions (axios, express/proxy-addr, body-parser, follow-redirects, form-data, ip-address, minimatch, brace-expansion) -> lockfile refreshed within the existing ranges - sqlite3 5 in the vendored web3-adapter, which pulls tar 6 via node-gyp 8 -> sqlite3 ^6.0.1 (tar 7) - the EOL node:20-alpine base, its outdated OpenSSL and bundled npm/yarn -> node:24-alpine, apk upgrade, npm/yarn/corepack removed from runtime Trivy 0.58.1 (HIGH,CRITICAL): 5 critical / 72 high -> 0 / 0. Also adds a .dockerignore. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The production image shipped three sources of known CVEs:

- the API's full node_modules, devDependencies included (jest, ts-jest,
  nodemon: handlebars, js-yaml, browserslist...) -> npm prune --omit=dev
- runtime deps locked at vulnerable versions (axios, express/proxy-addr,
  body-parser, follow-redirects, form-data, ip-address, minimatch,
  brace-expansion) -> lockfile refreshed within the existing ranges
- sqlite3 5 in the vendored web3-adapter, which pulls tar 6 via node-gyp 8
  -> sqlite3 ^6.0.1 (tar 7)
- the EOL node:20-alpine base, its outdated OpenSSL and bundled npm/yarn
  -> node:24-alpine, apk upgrade, npm/yarn/corepack removed from runtime

Trivy 0.58.1 (HIGH,CRITICAL): 5 critical / 72 high -> 0 / 0.
Also adds a .dockerignore.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
5247d105-9851-54b4-9e20-2475e9f7238b/ruby!1
No description provided.