3 releases 3 tags

RSS feed

• v0.1.1 3033d01d33

  Compare

  fix(docker): clear GitW3 vulnerability scan (5 critical, 72 high) Stable

  Andrei Puchkov released this 2026-10-28 12:39:37 +00:00 | 13 commits to main since this release

  The production image shipped three sources of known CVEs:

  • the API's full node_modules, devDependencies included (jest, ts-jest,
    nodemon: handlebars, js-yaml, browserslist...) -> npm prune --omit=dev
  • runtime deps locked at vulnerable versions (axios, express/proxy-addr,
    body-parser, follow-redirects, form-data, ip-address, minimatch,
    brace-expansion) -> lockfile refreshed within the existing ranges
  • sqlite3 5 in the vendored web3-adapter, which pulls tar 6 via node-gyp 8
    -> sqlite3 ^6.0.1 (tar 7)
  • the EOL node:20-alpine base, its outdated OpenSSL and bundled npm/yarn
    -> node:24-alpine, apk upgrade, npm/yarn/corepack removed from runtime

  Trivy 0.58.1 (HIGH,CRITICAL): 5 critical / 72 high -> 0 / 0.
  Also adds a .dockerignore.

  Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com