Repository navigation
chore(deps): take the proxy-addr and source-map-js fixes, repin distroless - #26
Merged
Merged
Conversation
…oless npm audit --audit-level=high (the CI gate) fails on main since the proxy-addr advisory GHSA-jqcg-44mw-7w3h (IPv4-mapped IPv6 trust subnet, critical) and the source-map-js advisory GHSA-68fv-2mgg-jv7q (indexed section offsets, high) were published. npm audit fix moves both within their existing ranges (2.0.8, 1.2.2); lockfile only, written with npm 10 as CI's Node 22 runs it. The Trivy step behind it failed on CVE-2026-75804 in libssl3t64 3.5.7-1~deb13u2. The distroless nodejs22-debian13:nonroot image is repinned to the current index digest, which carries the fixed OpenSSL.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
mainhas been red since 2026-10-12. Two separate failures in theverifyjob:npm audit --audit-level=high:proxy-addr2.0.7 is hit by GHSA-jqcg-44mw-7w3h, IP spoofing through an IPv4-mapped IPv6 trust subnet (critical).source-map-js1.2.1 is hit by GHSA-68fv-2mgg-jv7q, event-loop DoS through indexed section offsets (high).libssl3t643.5.7-1~deb13u2 from the distroless base.Change
package-lock.json:npm audit fixraisesproxy-addrto 2.0.8 andsource-map-jsto 1.2.2, both within their existing ranges. Lockfile only, written with npm 10 as CI's Node 22 runs it, which also drops a few"peer": truemarkers.Dockerfile:gcr.io/distroless/nodejs22-debian13:nonrootis repinned to the current index digestsha256:ec231376…, which carries the fixed OpenSSL.Verified locally
npm audit --audit-level=high: 0 vulnerabilities.npm ciwith npm 10: clean install.docker build --pull+scripts/runtime-smoke.js: PASS.test:requiredneeds the picpeak checkout and Postgres, so CI runs it.