fix: resolve critical vulnerabilities and upgrade Docker base image#1612
fix: resolve critical vulnerabilities and upgrade Docker base image#1612DeepakNemad merged 3 commits intomainfrom
Conversation
- Update axios from 1.13.5 to 1.16.0 to address CVE-2025-27152, CVE-2026-25639, CVE-2026-42033, CVE-2026-42035, CVE-2026-42043 - Rebuild Docker images with updated dependencies - Partial fix for high and critical security vulnerabilities identified by Trivy scan - Additional transitive dependency updates required for complete resolution Fixes: Multiple HIGH severity axios vulnerabilities Scan-tool: Trivy v0.70.0 Signed-off-by: DeepakNemad <deepak.nemade@ayanworks.com>
Security Updates: - Update protobufjs 7.5.4→7.5.6 (CVE-2026-41242 RCE fix) - Update handlebars 4.7.8→4.7.9 (CVE-2026-33937 template injection) - Update form-data 2.3.3→4.0.5 (CVE-2025-7783 critical fix) - Update winston 3.4.0→3.19.0, express 4.22.1→5.2.1 - Update helmet 7.2.0→8.1.0, bcrypt 5.1.1→6.0.0 - Update validator, unzipper, supertest to latest secure versions Dependency Management: - Add explicit versions for protobufjs, handlebars, form-data to package.json - Force secure versions of transitive dependencies via dependency pinning - Prevent vulnerable versions from being pulled by parent packages Infrastructure: - Upgrade Docker base image: node:24-alpine3.21 → node:24-alpine3.23 - Improve container security with latest Alpine Linux patches Signed-off-by: DeepakNemad <deepak.nemade@ayanworks.com>
DeepakNemad
requested review from
KambleSahil3,
RinkalBhojani,
ajile-in and
shitrerohit
|
Warning Rate limit exceeded
To continue reviewing without waiting, purchase usage credits in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📝 WalkthroughWalkthroughThis PR updates Node.js Alpine base images from version 3.21 to 3.23 across 16 Dockerfiles and bumps npm package versions including express (v4→v5), axios, bcrypt, helmet, winston, and test dependencies. ChangesDocker Base Image Updates
NPM Dependency Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsTimed out fetching pipeline failures after 30000ms Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
Dockerfiles/Dockerfile.agent-service (1)
36-36:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winFix typo in Prisma migrate command in agent-service startup.
Line 36 uses
deployywhich is not a valid Prisma subcommand and will fail at runtime, blocking container startup and preventing migrations. Change todeploy.Proposed fix
-CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deployy && cd ../.. && node dist/apps/agent-service/main.js"] +CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/agent-service/main.js"]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfiles/Dockerfile.agent-service` at line 36, The CMD in the container startup contains a typo: the Prisma subcommand is written as "deployy" which will fail; update the startup command string used in the Docker CMD (the line that runs cd libs/prisma-service && npx prisma migrate deployy && ...) to use the correct Prisma command "migrate deploy" (replace "deployy" with "deploy") so migrations run successfully before launching node dist/apps/agent-service/main.js.Dockerfiles/Dockerfile.agent-provisioning (1)
41-83:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRun the final image as non-root to avoid privileged runtime by default.
This Dockerfile lacks a
USERdirective in the runtime stage, unlike all 16 other Dockerfiles in this codebase. AddUSER nextjsafter adjusting ownership of/appto maintain consistency with the established hardening pattern.Suggested patch
FROM node:24-alpine3.23 @@ RUN set -eux \ && apk --no-cache add \ openssh-client \ aws-cli \ docker \ docker-compose \ jq \ && npm install -g pnpm --ignore-scripts \ && export PATH=$PATH:/usr/lib/node_modules/pnpm/bin \ + && addgroup -g 1001 -S nodejs \ + && adduser -S nextjs -u 1001 -G nodejs \ && rm -rf /var/cache/apk/* @@ COPY libs/ ./libs/ + +RUN chown -R nextjs:nodejs /app +USER nextjs @@ CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && npx prisma generate && cd ../.. && node dist/apps/agent-provisioning/main.js"]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfiles/Dockerfile.agent-provisioning` around lines 41 - 83, Add a non-root runtime user and adjust ownership of /app: create or ensure the "nextjs" user exists in the runtime image, chown -R /app to nextjs (and any created dirs like /app/agent-provisioning/AFJ) and then add a USER nextjs line before the final CMD so the container runs unprivileged; keep the existing chmod lines but perform chown (e.g., chown -R nextjs:nextjs /app) before switching to USER nextjs and ensure any commands in CMD (npx prisma, node dist/...) still run as that user.package.json (1)
139-139:⚠️ Potential issue | 🟠 Major | ⚡ Quick win
@types/expressmust be bumped to v5 to match the runtime upgrade to Express 5
@types/express@^4.17.25(line 139) provides Express 4 type definitions while the production runtime isexpress@^5.2.1(line 80). The current latest@types/expressis5.0.6. Using v4 types with Express 5 causes incompatibility and TypeScript compilation errors due to mismatched API surface.🛠️ Proposed fix
- "@types/express": "^4.17.25", + "@types/express": "^5.0.6",🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` at line 139, The package.json entry for the TypeScript types is outdated: replace the dependency "@types/express": "^4.17.25" with the Express 5 compatible version (e.g., "^5.0.6") so the `@types` package matches the runtime express@^5.2.1; update the dependency string for "@types/express" in package.json and run your install (or yarn/npm lockfile update) to ensure types and runtime are aligned.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 131: The dependency range for protobufjs in package.json currently allows
the vulnerable 7.5.5; update the version specifier from "protobufjs": "^7.5.5"
to a range that floors at 7.5.6 (for example "protobufjs": "^7.5.6" or ">=7.5.6
<8.0.0") so package managers cannot install 7.5.5; modify the protobufjs entry
in package.json (the dependency key "protobufjs") and then run your lockfile
update (pnpm install / pnpm update protobufjs) to regenerate the lockfile.
- Line 133: The dependency entry "form-data": "^4.0.4" in package.json allows
the vulnerable 4.0.4 to be installed; update the version spec to require at
least 4.0.5 (e.g. change the dependency value for "form-data" from "^4.0.4" to
"^4.0.5" or ">=4.0.5") so the package manager cannot resolve to the vulnerable
4.0.4 release.
---
Outside diff comments:
In `@Dockerfiles/Dockerfile.agent-provisioning`:
- Around line 41-83: Add a non-root runtime user and adjust ownership of /app:
create or ensure the "nextjs" user exists in the runtime image, chown -R /app to
nextjs (and any created dirs like /app/agent-provisioning/AFJ) and then add a
USER nextjs line before the final CMD so the container runs unprivileged; keep
the existing chmod lines but perform chown (e.g., chown -R nextjs:nextjs /app)
before switching to USER nextjs and ensure any commands in CMD (npx prisma, node
dist/...) still run as that user.
In `@Dockerfiles/Dockerfile.agent-service`:
- Line 36: The CMD in the container startup contains a typo: the Prisma
subcommand is written as "deployy" which will fail; update the startup command
string used in the Docker CMD (the line that runs cd libs/prisma-service && npx
prisma migrate deployy && ...) to use the correct Prisma command "migrate
deploy" (replace "deployy" with "deploy") so migrations run successfully before
launching node dist/apps/agent-service/main.js.
In `@package.json`:
- Line 139: The package.json entry for the TypeScript types is outdated: replace
the dependency "@types/express": "^4.17.25" with the Express 5 compatible
version (e.g., "^5.0.6") so the `@types` package matches the runtime
express@^5.2.1; update the dependency string for "@types/express" in
package.json and run your install (or yarn/npm lockfile update) to ensure types
and runtime are aligned.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: efde2fe1-bb07-4599-b7fa-5a1733eef3e9
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (20)
Dockerfiles/Dockerfile.agent-provisioningDockerfiles/Dockerfile.agent-serviceDockerfiles/Dockerfile.api-gatewayDockerfiles/Dockerfile.cloud-walletDockerfiles/Dockerfile.connectionDockerfiles/Dockerfile.ecosystemDockerfiles/Dockerfile.geolocationDockerfiles/Dockerfile.issuanceDockerfiles/Dockerfile.ledgerDockerfiles/Dockerfile.notificationDockerfiles/Dockerfile.oid4vc-issuanceDockerfiles/Dockerfile.oid4vc-verificationDockerfiles/Dockerfile.organizationDockerfiles/Dockerfile.seedDockerfiles/Dockerfile.userDockerfiles/Dockerfile.utilityDockerfiles/Dockerfile.verificationDockerfiles/Dockerfile.webhookDockerfiles/Dockerfile.x509package.json
Security Updates: - Update protobufjs 7.5.4→7.5.6 (CVE-2026-41242 RCE fix) - Update handlebars 4.7.8→4.7.9 (CVE-2026-33937 template injection) - Update form-data 2.3.3→4.0.5 (CVE-2025-7783 critical fix) - Update winston 3.4.0→3.19.0, express 4.22.1→5.2.1 - Update helmet 7.2.0→8.1.0, bcrypt 5.1.1→6.0.0 - Update validator, unzipper, supertest to latest secure versions Dependency Management: - Add explicit versions for protobufjs, handlebars, form-data to package.json - Force secure versions of transitive dependencies via dependency pinning - Prevent vulnerable versions from being pulled by parent packages Infrastructure: - Upgrade Docker base image: node:24-alpine3.21 → node:24-alpine3.23 - Improve container security with latest Alpine Linux patches Signed-off-by: DeepakNemad <deepak.nemade@ayanworks.com>
|
3 participants
Security Updates:
Dependency Management:
Infrastructure:
Summary by CodeRabbit
Chores