fix(security): patch HIGH/CRITICAL container image vulnerabilities #27

Merged

eliott merged 1 commit from security/2026-10-image-patching into main

2026-10-28 09:30:12 +01:00

eliott commented

2026-10-26 21:43:23 +01:00

Owner

Why

The vulan/Grype scan of the running rollnote-website container found 9 HIGH findings:

8 in the npm that the Node image bundles (/usr/local/lib/node_modules/npm): brace-expansion 5.0.7, undici 6.27.0, ip-address 10.2.0 and tar 7.5.19.
1 in Alpine zlib 1.3.2-r0.

What changed (Dockerfile only)

NODE_IMAGE node:24.21-alpine → node:24.22-alpine (24.22.1, Alpine 3.24.3, zlib 1.3.2-r1), in sync with the api/front images.
The runtime stage removes npm, npx, corepack and yarn. The server starts with node build, and the adapter-node bundle needs no package manager.

Scan: before → after

	before (prod container)	after (local `podman build`)
Grype `--only-fixed`, HIGH/CRITICAL	9	0
Grype `--only-fixed`, any severity	—	0

Verification (local)

pnpm lint (prettier + eslint), pnpm check (svelte-check: 0 errors, 0 warnings) and pnpm build: pass.
podman build: OK.
Smoke run with read-only rootfs and --cap-drop ALL: Listening on http://0.0.0.0:3000, and / and /health return 200.

What to check after deploy

Healthcheck green, and roll-note.com plus /changelog render. /changelog is server-rendered from the API.

Follow-ups

None. Base images are pinned by minor tag, so the next Alpine CVE needs another tag bump.

https://claude.ai/code/session_011Qbv9zPFHL8Ax1zQWXSov3

## Why The vulan/Grype scan of the running `rollnote-website` container found **9 HIGH findings**: - 8 in the npm that the Node image bundles (`/usr/local/lib/node_modules/npm`): `brace-expansion` 5.0.7, `undici` 6.27.0, `ip-address` 10.2.0 and `tar` 7.5.19. - 1 in Alpine `zlib` 1.3.2-r0. ## What changed (Dockerfile only) - `NODE_IMAGE` `node:24.21-alpine` → `node:24.22-alpine` (24.22.1, Alpine 3.24.3, zlib 1.3.2-r1), in sync with the api/front images. - The runtime stage removes npm, npx, corepack and yarn. The server starts with `node build`, and the adapter-node bundle needs no package manager. ## Scan: before → after | | before (prod container) | after (local `podman build`) | |---|---|---| | Grype `--only-fixed`, HIGH/CRITICAL | 9 | **0** | | Grype `--only-fixed`, any severity | — | 0 | ## Verification (local) - `pnpm lint` (prettier + eslint), `pnpm check` (svelte-check: 0 errors, 0 warnings) and `pnpm build`: pass. - `podman build`: OK. - Smoke run with read-only rootfs and `--cap-drop ALL`: `Listening on http://0.0.0.0:3000`, and `/` and `/health` return 200. ## What to check after deploy - Healthcheck green, and roll-note.com plus `/changelog` render. `/changelog` is server-rendered from the API. ## Follow-ups - None. Base images are pinned by minor tag, so the next Alpine CVE needs another tag bump. https://claude.ai/code/session_011Qbv9zPFHL8Ax1zQWXSov3

eliott added 1 commit

2026-10-26 21:43:23 +01:00

fix(security): patch HIGH/CRITICAL image vulnerabilities d5e7e0b3ef

- Node image 24.21-alpine -> 24.22-alpine (zlib 1.3.2-r1), in sync with
  the api/front images.
- Remove npm/corepack/yarn from the runtime stage: the server starts with
  `node build` and never needs them, and npm's bundled deps (tar, undici,
  ip-address, brace-expansion) were the image's remaining findings.

Grype (--only-fixed) on the built image: 9 findings -> 0.

Claude-Session: https://claude.ai/code/session_011Qbv9zPFHL8Ax1zQWXSov3

eliott merged commit 206a6302eb into main

2026-10-28 09:30:12 +01:00

eliott deleted branch security/2026-10-image-patching

2026-10-28 09:30:13 +01:00

eliott referenced this pull request from a commit

2026-10-28 09:30:13 +01:00

Merge pull request 'fix(security): patch HIGH/CRITICAL container image vulnerabilities' (#27) from security/2026-10-image-patching into main