Merge pull request #21 from topcoder-platform/security_july_2026

security: remediate July 2026 ECR findings

Author: jmgasper

.dockerignore

@@ -0,0 +1,10 @@
+.git
+.github
+.circleci
+.env
+.env.*
+!.env.example
+dist
+node_modules
+npm-debug.log*
+pnpm-debug.log*

.nvmrc

@@ -1 +1 @@
-22.13.1
+22.23.1

Dockerfile

@@ -1,12 +1,16 @@
 # ---- Base Stage ----
-FROM node:22.19-alpine AS base
-RUN apk add --no-cache openssh-client git openssl
+FROM node:22.23.1-alpine AS base
+RUN apk upgrade --no-cache
 WORKDIR /usr/src/app
 
+# ---- Tooling Stage ----
+FROM base AS tooling
+RUN npm install -g pnpm@11.15.1
+
 # ---- Dependencies Stage ----
-FROM base AS deps
-RUN npm install -g pnpm@10.33.2
-COPY package.json pnpm-lock.yaml ./
+FROM tooling AS deps
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY prisma ./prisma
 RUN pnpm install --frozen-lockfile
 
 # ---- Build Stage ----
@@ -15,14 +19,23 @@ COPY . .
 # Build the application (runs prisma generate via package script)
 RUN pnpm build
 
+# ---- Production Dependencies Stage ----
+FROM tooling AS prod-deps
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY prisma ./prisma
+RUN pnpm install --prod --frozen-lockfile --ignore-scripts \
+  && ./node_modules/.bin/prisma generate
+
 # ---- Production Stage ----
 FROM base AS production
 ENV NODE_ENV=production
 WORKDIR /usr/src/app
+RUN rm -rf /usr/local/lib/node_modules/npm \
+  && rm -f /usr/local/bin/npm /usr/local/bin/npx
 
 # Copy built artifacts and runtime deps
 COPY --from=build /usr/src/app/dist ./dist
-COPY --from=build /usr/src/app/node_modules ./node_modules
+COPY --from=prod-deps /usr/src/app/node_modules ./node_modules
 COPY --from=build /usr/src/app/prisma ./prisma
 COPY --from=build /usr/src/app/entrypoint.sh /entrypoint.sh
 

entrypoint.sh

@@ -10,7 +10,7 @@ echo "Starting Billing Accounts API v6..."
 
 echo "Running database migrations..."
 
-npx prisma migrate deploy
+/usr/src/app/node_modules/.bin/prisma migrate deploy
 
 # Check migration status
 if [ $? -eq 0 ]; then

package.json

@@ -4,10 +4,10 @@
   "private": true,
   "description": "Topcoder Billing Accounts & Clients API (NestJS + Prisma, CommonJS)",
   "main": "dist/main.js",
-  "packageManager": "pnpm@10.33.2",
+  "packageManager": "pnpm@11.15.1",
   "type": "commonjs",
   "scripts": {
-    "build": "prisma generate && nest build",
+    "build": "prisma generate && tsc --build tsconfig.json --force",
     "start:dev": "ts-node-dev --respawn --transpile-only src/main.ts",
     "start": "node dist/main.js",
     "lint": "eslint \"src/**/*.ts\" --fix",
@@ -22,54 +22,42 @@
     "generate:subcontractor-sql": "ts-node scripts/generate-subcontractor-sql.ts"
   },
   "dependencies": {
-    "@nestjs/cli": "^11.0.0",
-    "@nestjs/common": "^10.3.0",
-    "@nestjs/config": "^3.2.0",
-    "@nestjs/core": "^10.3.0",
-    "@nestjs/mapped-types": "^2.1.0",
-    "@nestjs/platform-express": "^10.3.0",
-    "@nestjs/swagger": "^7.4.2",
-    "@prisma/client": "^6.18.0",
-    "@types/express": "^5.0.3",
-    "axios": "^1.13.4",
+    "@nestjs/common": "^11.1.28",
+    "@nestjs/config": "^4.0.4",
+    "@nestjs/core": "^11.1.28",
+    "@nestjs/mapped-types": "^2.1.1",
+    "@nestjs/platform-express": "^11.1.28",
+    "@nestjs/swagger": "^11.4.6",
+    "@prisma/client": "^6.19.3",
+    "axios": "^1.18.1",
     "class-transformer": "^0.5.1",
-    "class-validator": "^0.14.0",
-    "dotenv": "^16.4.5",
+    "class-validator": "^0.14.4",
+    "dotenv": "^17.4.2",
     "jsonwebtoken": "^9.0.3",
-    "lodash": "^4.17.23",
+    "lodash": "^4.18.1",
     "pino": "^9.0.0",
-    "prisma": "^6.18.0",
-    "reflect-metadata": "^0.1.13",
-    "rimraf": "^5.0.7",
+    "prisma": "^6.19.3",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.2",
     "swagger-ui-express": "^5.0.0",
     "tc-core-library-js": "github:topcoder-platform/tc-core-library-js#master"
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.2.0",
     "@eslint/js": "^9.18.0",
-    "@types/axios": "^0.14.4",
+    "@types/express": "^5.0.6",
     "@types/jsonwebtoken": "^9.0.10",
     "@types/lodash": "^4.17.23",
     "@types/node": "^20.14.9",
     "eslint": "^9.18.0",
     "eslint-config-prettier": "^10.0.1",
     "eslint-plugin-prettier": "^5.1.3",
     "globals": "^16.3.0",
+    "prettier": "^3.6.2",
+    "rimraf": "^6.0.1",
     "ts-node": "^10.9.2",
     "ts-node-dev": "^2.0.0",
     "typescript": "^5.5.4",
     "typescript-eslint": "^8.38.0"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "@prisma/client",
-      "@prisma/engines",
-      "prisma"
-    ],
-    "ignoredBuiltDependencies": [
-      "@nestjs/core",
-      "@scarf/scarf",
-      "dtrace-provider"
-    ]
   }
 }

packages/ba-prisma-client/edge.js

@@ -36,12 +36,12 @@ exports.Prisma = Prisma
 exports.$Enums = {}
 
 /**
- * Prisma Client JS version: 6.19.0
- * Query Engine version: 2ba551f319ab1df4bc874a89965d8b3641056773
+ * Prisma Client JS version: 6.19.3
+ * Query Engine version: c2990dca591cba766e3b7ef5d9e8a84796e47ab7
  */
 Prisma.prismaVersion = {
-  client: "6.19.0",
-  engine: "2ba551f319ab1df4bc874a89965d8b3641056773"
+  client: "6.19.3",
+  engine: "c2990dca591cba766e3b7ef5d9e8a84796e47ab7"
 }
 
 Prisma.PrismaClientKnownRequestError = PrismaClientKnownRequestError;
@@ -201,7 +201,7 @@ const config = {
       "value": "prisma-client-js"
     },
     "output": {
-      "value": "/home/jmgasper/Documents/Git/v6/billing-accounts-api-v6/packages/ba-prisma-client",
+      "value": "/home/jmgasper/Documents/Git/v6/_security_worktrees/billing-accounts-api-v6/packages/ba-prisma-client",
       "fromEnvVar": null
     },
     "config": {
@@ -219,15 +219,15 @@ const config = {
       }
     ],
     "previewFeatures": [],
-    "sourceFilePath": "/home/jmgasper/Documents/Git/v6/billing-accounts-api-v6/prisma/schema.prisma",
+    "sourceFilePath": "/home/jmgasper/Documents/Git/v6/_security_worktrees/billing-accounts-api-v6/prisma/schema.prisma",
     "isCustomOutput": true
   },
   "relativeEnvPaths": {
     "rootEnvPath": null
   },
   "relativePath": "../../prisma",
-  "clientVersion": "6.19.0",
-  "engineVersion": "2ba551f319ab1df4bc874a89965d8b3641056773",
+  "clientVersion": "6.19.3",
+  "engineVersion": "c2990dca591cba766e3b7ef5d9e8a84796e47ab7",
   "datasourceNames": [
     "db"
   ],

packages/ba-prisma-client/index-browser.js

@@ -21,12 +21,12 @@ exports.Prisma = Prisma
 exports.$Enums = {}
 
 /**
- * Prisma Client JS version: 6.19.0
- * Query Engine version: 2ba551f319ab1df4bc874a89965d8b3641056773
+ * Prisma Client JS version: 6.19.3
+ * Query Engine version: c2990dca591cba766e3b7ef5d9e8a84796e47ab7
  */
 Prisma.prismaVersion = {
-  client: "6.19.0",
-  engine: "2ba551f319ab1df4bc874a89965d8b3641056773"
+  client: "6.19.3",
+  engine: "c2990dca591cba766e3b7ef5d9e8a84796e47ab7"
 }
 
 Prisma.PrismaClientKnownRequestError = () => {

packages/ba-prisma-client/index.d.ts

@@ -305,8 +305,8 @@ export namespace Prisma {
   export import Exact = $Public.Exact
 
   /**
-   * Prisma Client JS version: 6.19.0
-   * Query Engine version: 2ba551f319ab1df4bc874a89965d8b3641056773
+   * Prisma Client JS version: 6.19.3
+   * Query Engine version: c2990dca591cba766e3b7ef5d9e8a84796e47ab7
    */
   export type PrismaVersion = {
     client: string

packages/ba-prisma-client/index.js

@@ -36,12 +36,12 @@ exports.Prisma = Prisma
 exports.$Enums = {}
 
 /**
- * Prisma Client JS version: 6.19.0
- * Query Engine version: 2ba551f319ab1df4bc874a89965d8b3641056773
+ * Prisma Client JS version: 6.19.3
+ * Query Engine version: c2990dca591cba766e3b7ef5d9e8a84796e47ab7
  */
 Prisma.prismaVersion = {
-  client: "6.19.0",
-  engine: "2ba551f319ab1df4bc874a89965d8b3641056773"
+  client: "6.19.3",
+  engine: "c2990dca591cba766e3b7ef5d9e8a84796e47ab7"
 }
 
 Prisma.PrismaClientKnownRequestError = PrismaClientKnownRequestError;
@@ -202,7 +202,7 @@ const config = {
       "value": "prisma-client-js"
     },
     "output": {
-      "value": "/home/jmgasper/Documents/Git/v6/billing-accounts-api-v6/packages/ba-prisma-client",
+      "value": "/home/jmgasper/Documents/Git/v6/_security_worktrees/billing-accounts-api-v6/packages/ba-prisma-client",
       "fromEnvVar": null
     },
     "config": {
@@ -220,15 +220,15 @@ const config = {
       }
     ],
     "previewFeatures": [],
-    "sourceFilePath": "/home/jmgasper/Documents/Git/v6/billing-accounts-api-v6/prisma/schema.prisma",
+    "sourceFilePath": "/home/jmgasper/Documents/Git/v6/_security_worktrees/billing-accounts-api-v6/prisma/schema.prisma",
     "isCustomOutput": true
   },
   "relativeEnvPaths": {
     "rootEnvPath": null
   },
   "relativePath": "../../prisma",
-  "clientVersion": "6.19.0",
-  "engineVersion": "2ba551f319ab1df4bc874a89965d8b3641056773",
+  "clientVersion": "6.19.3",
+  "engineVersion": "c2990dca591cba766e3b7ef5d9e8a84796e47ab7",
   "datasourceNames": [
     "db"
   ],