Skip to content

Commit 8951fd6

Browse files
jmgasperjmgasper
committed
security: remediate July 2026 ECR findings
Addresses CVE-2026-25547, CVE-2026-35515, CVE-2026-48758, GHSA-jfc7-64v2-mr8c, CVE-2025-62718, CVE-2026-25639, CVE-2026-40175, CVE-2026-42033, CVE-2026-42034, CVE-2026-42036, CVE-2026-42038, CVE-2026-42039, CVE-2026-42041, CVE-2026-42042, CVE-2026-42043, CVE-2026-42044, CVE-2026-42264, CVE-2026-44486, CVE-2026-44488, CVE-2026-44490, CVE-2026-44492, CVE-2026-44494, CVE-2026-44495, CVE-2026-44496, CVE-2026-33750, CVE-2026-5545, CVE-2026-35209, CVE-2026-24001, CVE-2026-32887, CVE-2026-6321, CVE-2026-31808, CVE-2026-32141, CVE-2026-33228, GHSA-r4q5-vmmm-2653, CVE-2026-12143, CVE-2025-64756, CVE-2026-42338, CVE-2025-64718, CVE-2026-2950, CVE-2026-26996, CVE-2026-27903, CVE-2026-3304, CVE-2026-3520, CVE-2026-5038, CVE-2026-40200, CVE-2025-55130, CVE-2025-55131, CVE-2025-55132, CVE-2025-59464, CVE-2025-59465, CVE-2025-59466, CVE-2026-21710, CVE-2026-21713, CVE-2026-21714, CVE-2026-21717, CVE-2026-48928, CVE-2025-15467, CVE-2025-68160, CVE-2025-69418, CVE-2025-69420, CVE-2025-69421, CVE-2025-9230, CVE-2026-22795, CVE-2026-22796, CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-31790, CVE-2026-34182, CVE-2026-42766, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-7383, CVE-2026-9076, CVE-2026-33671, CVE-2026-33672, CVE-2026-2391, CVE-2026-8723, GHSA-5c6j-r48x-rmvq, CVE-2026-48815, GHSA-52v5-jr5w-gjxr, CVE-2026-23745, CVE-2026-24842, CVE-2026-26960, CVE-2026-29786, CVE-2026-22184, and CVE-2026-27171 from ECR image tag 90. Pins Node 22.23.1 in local and Docker runtimes, upgrades Nest and Prisma, overrides vulnerable transitive packages, regenerates the checked-in Prisma client, and uses a clean production install. The migration entrypoint invokes the bundled Prisma CLI directly so npm/npx can be removed from the runtime image.
1 parent 6419b69 commit 8951fd6

21 files changed

Lines changed: 741 additions & 2325 deletions

‎.dockerignore‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
.git
2+
.github
3+
.circleci
4+
.env
5+
.env.*
6+
!.env.example
7+
dist
8+
node_modules
9+
npm-debug.log*
10+
pnpm-debug.log*

‎.nvmrc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
22.13.1
1+
22.23.1

‎Dockerfile‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,16 @@
11
# ---- Base Stage ----
2-
FROM node:22.19-alpine AS base
3-
RUN apk add --no-cache openssh-client git openssl
2+
FROM node:22.23.1-alpine AS base
3+
RUN apk upgrade --no-cache
44
WORKDIR /usr/src/app
55

6+
# ---- Tooling Stage ----
7+
FROM base AS tooling
8+
RUN npm install -g pnpm@11.15.1
9+
610
# ---- Dependencies Stage ----
7-
FROM base AS deps
8-
RUN npm install -g pnpm@10.33.2
9-
COPY package.json pnpm-lock.yaml ./
11+
FROM tooling AS deps
12+
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
13+
COPY prisma ./prisma
1014
RUN pnpm install --frozen-lockfile
1115

1216
# ---- Build Stage ----
@@ -15,14 +19,23 @@ COPY . .
1519
# Build the application (runs prisma generate via package script)
1620
RUN pnpm build
1721

22+
# ---- Production Dependencies Stage ----
23+
FROM tooling AS prod-deps
24+
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
25+
COPY prisma ./prisma
26+
RUN pnpm install --prod --frozen-lockfile --ignore-scripts \
27+
&& ./node_modules/.bin/prisma generate
28+
1829
# ---- Production Stage ----
1930
FROM base AS production
2031
ENV NODE_ENV=production
2132
WORKDIR /usr/src/app
33+
RUN rm -rf /usr/local/lib/node_modules/npm \
34+
&& rm -f /usr/local/bin/npm /usr/local/bin/npx
2235

2336
# Copy built artifacts and runtime deps
2437
COPY --from=build /usr/src/app/dist ./dist
25-
COPY --from=build /usr/src/app/node_modules ./node_modules
38+
COPY --from=prod-deps /usr/src/app/node_modules ./node_modules
2639
COPY --from=build /usr/src/app/prisma ./prisma
2740
COPY --from=build /usr/src/app/entrypoint.sh /entrypoint.sh
2841

‎entrypoint.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ echo "Starting Billing Accounts API v6..."
1010

1111
echo "Running database migrations..."
1212

13-
npx prisma migrate deploy
13+
/usr/src/app/node_modules/.bin/prisma migrate deploy
1414

1515
# Check migration status
1616
if [ $? -eq 0 ]; then

‎package.json‎

Lines changed: 19 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@
44
"private": true,
55
"description": "Topcoder Billing Accounts & Clients API (NestJS + Prisma, CommonJS)",
66
"main": "dist/main.js",
7-
"packageManager": "pnpm@10.33.2",
7+
"packageManager": "pnpm@11.15.1",
88
"type": "commonjs",
99
"scripts": {
10-
"build": "prisma generate && nest build",
10+
"build": "prisma generate && tsc --build tsconfig.json --force",
1111
"start:dev": "ts-node-dev --respawn --transpile-only src/main.ts",
1212
"start": "node dist/main.js",
1313
"lint": "eslint \"src/**/*.ts\" --fix",
@@ -22,54 +22,42 @@
2222
"generate:subcontractor-sql": "ts-node scripts/generate-subcontractor-sql.ts"
2323
},
2424
"dependencies": {
25-
"@nestjs/cli": "^11.0.0",
26-
"@nestjs/common": "^10.3.0",
27-
"@nestjs/config": "^3.2.0",
28-
"@nestjs/core": "^10.3.0",
29-
"@nestjs/mapped-types": "^2.1.0",
30-
"@nestjs/platform-express": "^10.3.0",
31-
"@nestjs/swagger": "^7.4.2",
32-
"@prisma/client": "^6.18.0",
33-
"@types/express": "^5.0.3",
34-
"axios": "^1.13.4",
25+
"@nestjs/common": "^11.1.28",
26+
"@nestjs/config": "^4.0.4",
27+
"@nestjs/core": "^11.1.28",
28+
"@nestjs/mapped-types": "^2.1.1",
29+
"@nestjs/platform-express": "^11.1.28",
30+
"@nestjs/swagger": "^11.4.6",
31+
"@prisma/client": "^6.19.3",
32+
"axios": "^1.18.1",
3533
"class-transformer": "^0.5.1",
36-
"class-validator": "^0.14.0",
37-
"dotenv": "^16.4.5",
34+
"class-validator": "^0.14.4",
35+
"dotenv": "^17.4.2",
3836
"jsonwebtoken": "^9.0.3",
39-
"lodash": "^4.17.23",
37+
"lodash": "^4.18.1",
4038
"pino": "^9.0.0",
41-
"prisma": "^6.18.0",
42-
"reflect-metadata": "^0.1.13",
43-
"rimraf": "^5.0.7",
39+
"prisma": "^6.19.3",
40+
"reflect-metadata": "^0.2.2",
41+
"rxjs": "^7.8.2",
4442
"swagger-ui-express": "^5.0.0",
4543
"tc-core-library-js": "github:topcoder-platform/tc-core-library-js#master"
4644
},
4745
"devDependencies": {
4846
"@eslint/eslintrc": "^3.2.0",
4947
"@eslint/js": "^9.18.0",
50-
"@types/axios": "^0.14.4",
48+
"@types/express": "^5.0.6",
5149
"@types/jsonwebtoken": "^9.0.10",
5250
"@types/lodash": "^4.17.23",
5351
"@types/node": "^20.14.9",
5452
"eslint": "^9.18.0",
5553
"eslint-config-prettier": "^10.0.1",
5654
"eslint-plugin-prettier": "^5.1.3",
5755
"globals": "^16.3.0",
56+
"prettier": "^3.6.2",
57+
"rimraf": "^6.0.1",
5858
"ts-node": "^10.9.2",
5959
"ts-node-dev": "^2.0.0",
6060
"typescript": "^5.5.4",
6161
"typescript-eslint": "^8.38.0"
62-
},
63-
"pnpm": {
64-
"onlyBuiltDependencies": [
65-
"@prisma/client",
66-
"@prisma/engines",
67-
"prisma"
68-
],
69-
"ignoredBuiltDependencies": [
70-
"@nestjs/core",
71-
"@scarf/scarf",
72-
"dtrace-provider"
73-
]
7462
}
7563
}

‎packages/ba-prisma-client/edge.js‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,12 @@ exports.Prisma = Prisma
3636
exports.$Enums = {}
3737

3838
/**
39-
* Prisma Client JS version: 6.19.0
40-
* Query Engine version: 2ba551f319ab1df4bc874a89965d8b3641056773
39+
* Prisma Client JS version: 6.19.3
40+
* Query Engine version: c2990dca591cba766e3b7ef5d9e8a84796e47ab7
4141
*/
4242
Prisma.prismaVersion = {
43-
client: "6.19.0",
44-
engine: "2ba551f319ab1df4bc874a89965d8b3641056773"
43+
client: "6.19.3",
44+
engine: "c2990dca591cba766e3b7ef5d9e8a84796e47ab7"
4545
}
4646

4747
Prisma.PrismaClientKnownRequestError = PrismaClientKnownRequestError;
@@ -201,7 +201,7 @@ const config = {
201201
"value": "prisma-client-js"
202202
},
203203
"output": {
204-
"value": "/home/jmgasper/Documents/Git/v6/billing-accounts-api-v6/packages/ba-prisma-client",
204+
"value": "/home/jmgasper/Documents/Git/v6/_security_worktrees/billing-accounts-api-v6/packages/ba-prisma-client",
205205
"fromEnvVar": null
206206
},
207207
"config": {
@@ -219,15 +219,15 @@ const config = {
219219
}
220220
],
221221
"previewFeatures": [],
222-
"sourceFilePath": "/home/jmgasper/Documents/Git/v6/billing-accounts-api-v6/prisma/schema.prisma",
222+
"sourceFilePath": "/home/jmgasper/Documents/Git/v6/_security_worktrees/billing-accounts-api-v6/prisma/schema.prisma",
223223
"isCustomOutput": true
224224
},
225225
"relativeEnvPaths": {
226226
"rootEnvPath": null
227227
},
228228
"relativePath": "../../prisma",
229-
"clientVersion": "6.19.0",
230-
"engineVersion": "2ba551f319ab1df4bc874a89965d8b3641056773",
229+
"clientVersion": "6.19.3",
230+
"engineVersion": "c2990dca591cba766e3b7ef5d9e8a84796e47ab7",
231231
"datasourceNames": [
232232
"db"
233233
],

‎packages/ba-prisma-client/index-browser.js‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,12 @@ exports.Prisma = Prisma
2121
exports.$Enums = {}
2222

2323
/**
24-
* Prisma Client JS version: 6.19.0
25-
* Query Engine version: 2ba551f319ab1df4bc874a89965d8b3641056773
24+
* Prisma Client JS version: 6.19.3
25+
* Query Engine version: c2990dca591cba766e3b7ef5d9e8a84796e47ab7
2626
*/
2727
Prisma.prismaVersion = {
28-
client: "6.19.0",
29-
engine: "2ba551f319ab1df4bc874a89965d8b3641056773"
28+
client: "6.19.3",
29+
engine: "c2990dca591cba766e3b7ef5d9e8a84796e47ab7"
3030
}
3131

3232
Prisma.PrismaClientKnownRequestError = () => {

‎packages/ba-prisma-client/index.d.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -305,8 +305,8 @@ export namespace Prisma {
305305
export import Exact = $Public.Exact
306306

307307
/**
308-
* Prisma Client JS version: 6.19.0
309-
* Query Engine version: 2ba551f319ab1df4bc874a89965d8b3641056773
308+
* Prisma Client JS version: 6.19.3
309+
* Query Engine version: c2990dca591cba766e3b7ef5d9e8a84796e47ab7
310310
*/
311311
export type PrismaVersion = {
312312
client: string

‎packages/ba-prisma-client/index.js‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,12 @@ exports.Prisma = Prisma
3636
exports.$Enums = {}
3737

3838
/**
39-
* Prisma Client JS version: 6.19.0
40-
* Query Engine version: 2ba551f319ab1df4bc874a89965d8b3641056773
39+
* Prisma Client JS version: 6.19.3
40+
* Query Engine version: c2990dca591cba766e3b7ef5d9e8a84796e47ab7
4141
*/
4242
Prisma.prismaVersion = {
43-
client: "6.19.0",
44-
engine: "2ba551f319ab1df4bc874a89965d8b3641056773"
43+
client: "6.19.3",
44+
engine: "c2990dca591cba766e3b7ef5d9e8a84796e47ab7"
4545
}
4646

4747
Prisma.PrismaClientKnownRequestError = PrismaClientKnownRequestError;
@@ -202,7 +202,7 @@ const config = {
202202
"value": "prisma-client-js"
203203
},
204204
"output": {
205-
"value": "/home/jmgasper/Documents/Git/v6/billing-accounts-api-v6/packages/ba-prisma-client",
205+
"value": "/home/jmgasper/Documents/Git/v6/_security_worktrees/billing-accounts-api-v6/packages/ba-prisma-client",
206206
"fromEnvVar": null
207207
},
208208
"config": {
@@ -220,15 +220,15 @@ const config = {
220220
}
221221
],
222222
"previewFeatures": [],
223-
"sourceFilePath": "/home/jmgasper/Documents/Git/v6/billing-accounts-api-v6/prisma/schema.prisma",
223+
"sourceFilePath": "/home/jmgasper/Documents/Git/v6/_security_worktrees/billing-accounts-api-v6/prisma/schema.prisma",
224224
"isCustomOutput": true
225225
},
226226
"relativeEnvPaths": {
227227
"rootEnvPath": null
228228
},
229229
"relativePath": "../../prisma",
230-
"clientVersion": "6.19.0",
231-
"engineVersion": "2ba551f319ab1df4bc874a89965d8b3641056773",
230+
"clientVersion": "6.19.3",
231+
"engineVersion": "c2990dca591cba766e3b7ef5d9e8a84796e47ab7",
232232
"datasourceNames": [
233233
"db"
234234
],

‎packages/ba-prisma-client/libquery_engine-debian-openssl-3.0.x.so.node‎

0 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)