Fix all npm audit vulnerabilities and use zero-CVE postgres image - #19
Open
Vanguadm wants to merge 1 commit into
Open
Fix all npm audit vulnerabilities and use zero-CVE postgres image#19Vanguadm wants to merge 1 commit into
Vanguadm wants to merge 1 commit into
Conversation
- Upgrade jest to ^30.4.2 (reverts accidental downgrade to ^25 that pulled in the critical form-data/request chain, node-notifier, and the old sane/braces/qs/tough-cookie tree) - Align @testcontainers/postgresql with testcontainers at ^12.0.4, dropping the nested testcontainers 10.x carrying vulnerable undici 6.x, dockerode 4.x, and uuid - Add overrides.minimatch ^10.2.5 so every glob/minimatch consumer resolves brace-expansion 5.0.8 - the only patched version for GHSA-mh99-v99m-4gvg, which has no in-range fix even in latest jest 30 and testcontainers 12 - Bump engines.node to >=18.14.0 (jest 30 floor) - Switch the postgres test image to cgr.dev/chainguard/postgres:latest; all official postgres alpine tags carry 1 critical/16 high CVEs in shared base layers, Chainguard scans at zero npm audit: 40 vulnerabilities (2 critical, 24 high, 14 moderate) -> 0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
npm auditreported 40 vulnerabilities (2 critical, 24 high, 14 moderate). This PR takes it to 0, and moves the test image to one that scans at zero CVEs.^25.0.0->^30.4.2— the old jest tree supplied the criticalform-data/requestchain (via jsdom),node-notifiercommand injection, and thesane/braces/qs/tough-cookieadvisories@testcontainers/postgresql^10.3.2->^12.0.4— aligns withtestcontainers ^12.0.4, removing the nested testcontainers 10.x that carried vulnerableundici6.x,dockerode4.x, anduuidoverrides.minimatch: ^10.2.5— the brace-expansion DoS (GHSA-mh99-v99m-4gvg) is only patched inbrace-expansion@5.0.8, and no in-range fix exists anywhere: even latest jest 30 and testcontainers 12 pullglob@10->minimatch@9-> vulnerable brace-expansion. The override forces every consumer ontominimatch 10.2.5, which resolvesbrace-expansion 5.0.8engines.node>=16.0.0->>=18.14.0— jest 30's floorpostgres:14-alpine->cgr.dev/chainguard/postgres:latest— every officialpostgres:*-alpinetag currently scans with 1 critical + 16 high CVEs in the shared base layers; the Chainguard image scans at 0 and honors the samePOSTGRES_*env vars and/docker-entrypoint-initdb.d/contract the test relies onVerification
npm audit: 0 vulnerabilities (was 40)npm ls minimatch brace-expansion glob undici dockerode: all consumers resolve minimatch 10.2.5 / brace-expansion 5.0.8; undici 8.9.0; dockerode 5.0.1; single deduped testcontainers 12.0.4npx jest --listTestsconfirms the jest 30 toolchain loads and discovers the suite; the full suite runs in CI against Testcontainers Cloud🤖 Generated with Claude Code