jason.woltje/professional-website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(docker): remove bundled npm from runner to clear Trivy CVEs #4

Merged
jason.woltje merged 1 commits from fix/trivy-remove-bundled-npm into main 2026-04-14 03:49:54 +00:00
Conversation 0 Commits 1 Files Changed 1 +2
jason.woltje commented 2026-04-14 03:48:04 +00:00
Owner
Copy Link

Trivy on pipeline #10 flagged HIGH CVEs in bundled by the base image (minimatch 10.2.2, picomatch 4.0.3, tar 7.5.9). Our runtime is from the standalone Next output; npm/corepack are unused at runtime.

Changes

  • Runner stage deletes , ━━━ Corepack - 0.34.6 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

    $ corepack

━━━ General commands ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

corepack cache clean
Cleans Corepack cache

corepack disable [--install-directory #0] ...
Remove the Corepack shims from the install directory

corepack enable [--install-directory #0] ...
Add the Corepack shims to the install directory

corepack install
Install the package manager configured in the local project

corepack install <-g,--global> [--cache-only] ...
Install package managers on the system

corepack pack [--json] [-o,--output #0] ...
Store package managers in a tarball

corepack up
Update the package manager used in the current project

corepack use 
Define the package manager to use for the current project

You can also print more details about any of these commands by calling them with
the -h,--help flag right after the command name., and the matching shims.

  • Clears CVE-2026-27903/27904/33671/29786/31802.

Test plan

  • PR pipeline lint/typecheck/build green
  • On merge: Kaniko builds, Trivy HIGH/CRITICAL clean, link-package succeeds
Trivy on pipeline #10 flagged HIGH CVEs in bundled by the base image (minimatch 10.2.2, picomatch 4.0.3, tar 7.5.9). Our runtime is from the standalone Next output; npm/corepack are unused at runtime. ## Changes - Runner stage deletes , ━━━ Corepack - 0.34.6 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ $ corepack <command> ━━━ General commands ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ corepack cache clean Cleans Corepack cache corepack disable [--install-directory #0] ... Remove the Corepack shims from the install directory corepack enable [--install-directory #0] ... Add the Corepack shims to the install directory corepack install Install the package manager configured in the local project corepack install <-g,--global> [--cache-only] ... Install package managers on the system corepack pack [--json] [-o,--output #0] ... Store package managers in a tarball corepack up Update the package manager used in the current project corepack use <pattern> Define the package manager to use for the current project You can also print more details about any of these commands by calling them with the `-h,--help` flag right after the command name., and the matching shims. - Clears CVE-2026-27903/27904/33671/29786/31802. ## Test plan - [ ] PR pipeline lint/typecheck/build green - [ ] On merge: Kaniko builds, Trivy HIGH/CRITICAL clean, link-package succeeds
jason.woltje added 1 commit 2026-04-14 03:48:04 +00:00
fix(docker): remove bundled npm from runner to eliminate Trivy CVE matches
All checks were successful
ci/woodpecker/push/web Pipeline was successful
Details
ci/woodpecker/pr/web Pipeline was successful
Details
e67727e009 
The node:24-alpine base image ships /usr/local/lib/node_modules/npm which
bundles outdated minimatch, picomatch, and tar. We run the standalone Next
server with 'node server.js' at runtime and never need npm/corepack in the
runner, so delete them entirely. Clears CVE-2026-27903/27904/33671/29786/31802.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
jason.woltje merged commit 6db28bc81f into main 2026-04-14 03:49:54 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: jason.woltje/professional-website#4
Delete Branch "fix/trivy-remove-bundled-npm"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?