[PR #4708] [MERGED] chore: security patches for dependency chain #4907

New issue

Closed

opened 2026-03-17 02:24:08 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:24:08 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/4708
Author: @AndrewBastin
Created: 1/29/2025
Status: ✅ Merged
Merged: 1/29/2025
Merged by: @jamesgeorge007

Base: next ← Head: chore/security-patches

📝 Commits (4)

dddf4ce chore: pin packages and update dockerfile to reduce vulnerable packages
ac1ed98 chore: add checksum verification for caddy building
3523b7e fix: build issues on arm
d3225aa chore: correct typo

📊 Changes

3 files changed (+136 additions, -84 deletions)

View changed files

📝 package.json (+4 -1)
📝 pnpm-lock.yaml (+43 -51)
📝 prod.Dockerfile (+89 -32)

📄 Description

This PR intends to clear out most of the security alerts (tested against Trivy and Docker Scout) regarding dependencies in the dependency trees having CVEs.

Closes HSB-519.

What's changed

Update the containers to use Alpine 3.19.6 directly (alpine:3.19.6) instead of node:20-alpine3.19.
NPM is now sourced from the npmjs.com/install.sh (pinned to v10.9.2 as its the latest version for Node 20)
Pin certain npm packages on the chain to the fixed versions.
Have a custom build of Caddy generated in the docker build step itself to clear Caddy related warnings.

Notes to reviewers

Please do test the AIO and the single containers

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/4708 **Author:** [@AndrewBastin](https://github.com/AndrewBastin) **Created:** 1/29/2025 **Status:** ✅ Merged **Merged:** 1/29/2025 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `next` ← **Head:** `chore/security-patches` --- ### 📝 Commits (4) - [`dddf4ce`](https://github.com/hoppscotch/hoppscotch/commit/dddf4ce7a1b4f6bcc80384354a363a7f94c4042d) chore: pin packages and update dockerfile to reduce vulnerable packages - [`ac1ed98`](https://github.com/hoppscotch/hoppscotch/commit/ac1ed984f35ab673239c046f749f70d770f6535b) chore: add checksum verification for caddy building - [`3523b7e`](https://github.com/hoppscotch/hoppscotch/commit/3523b7e7322641fe5e6e4c4fba410e8145291113) fix: build issues on arm - [`d3225aa`](https://github.com/hoppscotch/hoppscotch/commit/d3225aa96eb497a7929d5da87aeed9b33d6eb809) chore: correct typo ### 📊 Changes **3 files changed** (+136 additions, -84 deletions) <details> <summary>View changed files</summary> 📝 `package.json` (+4 -1) 📝 `pnpm-lock.yaml` (+43 -51) 📝 `prod.Dockerfile` (+89 -32) </details> ### 📄 Description This PR intends to clear out most of the security alerts (tested against Trivy and Docker Scout) regarding dependencies in the dependency trees having CVEs. Closes HSB-519. ### What's changed 1. Update the containers to use Alpine 3.19.6 directly (alpine:3.19.6) instead of node:20-alpine3.19. 2. NPM is now sourced from the npmjs.com/install.sh (pinned to v10.9.2 as its the latest version for Node 20) 3. Pin certain npm packages on the chain to the fixed versions. 4. Have a custom build of Caddy generated in the docker build step itself to clear Caddy related warnings. ### Notes to reviewers Please do test the AIO and the single containers --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>