mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-12 18:22:48 +03:00
08a8a871be
Trivy reported 9 HIGH/MEDIUM CVEs against the npm CLI's own bundled node_modules inside the published image (brace-expansion, ip-address, tar, undici under /usr/local/lib/node_modules/npm/node_modules). The base stage claimed `npm install -g npm@latest` shipped patched copies. It does not: npm@12.0.2 (latest) bundles brace-expansion 5.0.7, ip-address 10.2.0, tar 7.5.19 and undici 6.27.0 — all still vulnerable. No npm release fixes them, so that step was buying zero CVEs. Overlay the patched versions onto npm's bundled tree instead, pinned and semver-compatible with the ranges npm's own tree declares (minimatch -> brace-expansion ^5.0.5, socks -> ip-address ^10.1.1, node-gyp -> tar ^7.5.4 and undici ^6.25.0, so undici stays on 6.x). Removing npm from the runner stages was not viable — the app shells out to npm at runtime (installers/utils.ts::runNpm, system/autoUpdate.ts, system/globalPackagePath.ts, api/system/version) — and the old comment asserting otherwise is corrected.