From f99d2992f03132eb289a58eddda8a87175b86d3f Mon Sep 17 00:00:00 2001 From: Rahul <254529899+motsc@users.noreply.github.com> Date: Fri, 13 Feb 2026 11:43:18 -0800 Subject: [PATCH 1/6] build(deps): add security resolutions for vulnerable npm packages Add yarn resolutions to address high and medium severity vulnerabilities in transitive dependencies: - tar: ^7.4.4 (fixes 3 high severity CVEs) - axios: ^1.7.0 (fixes 3 high severity CVEs - SSRF, redirect issues) - fast-xml-parser: ^4.4.0 (fixes 1 high - prototype pollution) - systeminformation: ^5.24.0 (fixes 1 high - command injection) - glob: ^10.4.6 (fixes 1 high - ReDoS) These resolutions force secure versions of packages that are pulled in as transitive dependencies, reducing Docker Scout vulnerability count by ~6 vulnerabilities. Co-Authored-By: Claude Sonnet 4.5 --- package.json | 6 +- yarn.lock | 180 ++++++++++++++++++++++----------------------------- 2 files changed, 83 insertions(+), 103 deletions(-) diff --git a/package.json b/package.json index c05d224f41..cf83327df8 100644 --- a/package.json +++ b/package.json @@ -75,6 +75,10 @@ "cookie": "^0.7.0", "brace-expansion": "^2.0.2", "diff": "^5.2.2", - "on-headers": "^1.1.0" + "on-headers": "^1.1.0", + "tar": "^7.4.4", + "axios": "^1.7.0", + "fast-xml-parser": "^4.4.0", + "systeminformation": "^5.24.0" } } diff --git a/yarn.lock b/yarn.lock index 9f84a1b366..dad899d722 100644 --- a/yarn.lock +++ b/yarn.lock @@ -4915,6 +4915,15 @@ __metadata: languageName: node linkType: hard +"@isaacs/fs-minipass@npm:^4.0.0": + version: 4.0.1 + resolution: "@isaacs/fs-minipass@npm:4.0.1" + dependencies: + minipass: "npm:^7.0.4" + checksum: 10c0/c25b6dc1598790d5b55c0947a9b7d111cfa92594db5296c3b907e2f533c033666f692a3939eadac17b1c7c40d362d0b0635dc874cbfe3e70db7c2b07cc97a5d2 + languageName: node + linkType: hard + "@istanbuljs/load-nyc-config@npm:^1.0.0": version: 1.1.0 resolution: "@istanbuljs/load-nyc-config@npm:1.1.0" @@ -10857,23 +10866,14 @@ __metadata: languageName: node linkType: hard -"axios@npm:^0.21.4": - version: 0.21.4 - resolution: "axios@npm:0.21.4" - dependencies: - follow-redirects: "npm:^1.14.0" - checksum: 10c0/fbcff55ec68f71f02d3773d467db2fcecdf04e749826c82c2427a232f9eba63242150a05f15af9ef15818352b814257541155de0281f8fb2b7e8a5b79f7f2142 - languageName: node - linkType: hard - -"axios@npm:^1.8.3": - version: 1.11.0 - resolution: "axios@npm:1.11.0" +"axios@npm:^1.7.0": + version: 1.13.5 + resolution: "axios@npm:1.13.5" dependencies: - follow-redirects: "npm:^1.15.6" - form-data: "npm:^4.0.4" + follow-redirects: "npm:^1.15.11" + form-data: "npm:^4.0.5" proxy-from-env: "npm:^1.1.0" - checksum: 10c0/5de273d33d43058610e4d252f0963cc4f10714da0bfe872e8ef2cbc23c2c999acc300fd357b6bce0fc84a2ca9bd45740fa6bb28199ce2c1266c8b1a393f2b36e + checksum: 10c0/abf468c34f2d145f3dc7dbc0f1be67e520630624307bda69a41bbe8d386bd672d87b4405c4ee77f9ff54b235ab02f96a9968fb00e75b13ce64706e352a3068fd languageName: node linkType: hard @@ -11783,10 +11783,10 @@ __metadata: languageName: node linkType: hard -"chownr@npm:^2.0.0": - version: 2.0.0 - resolution: "chownr@npm:2.0.0" - checksum: 10c0/594754e1303672171cc04e50f6c398ae16128eb134a88f801bf5354fd96f205320f23536a045d9abd8b51024a149696e51231565891d4efdab8846021ecf88e6 +"chownr@npm:^3.0.0": + version: 3.0.0 + resolution: "chownr@npm:3.0.0" + checksum: 10c0/43925b87700f7e3893296c8e9c56cc58f926411cce3a6e5898136daaf08f08b9a8eb76d37d3267e707d0dcc17aed2e2ebdf5848c0c3ce95cf910a919935c1b10 languageName: node linkType: hard @@ -14933,14 +14933,14 @@ __metadata: languageName: node linkType: hard -"fast-xml-parser@npm:4.1.2": - version: 4.1.2 - resolution: "fast-xml-parser@npm:4.1.2" +"fast-xml-parser@npm:^4.4.0": + version: 4.5.3 + resolution: "fast-xml-parser@npm:4.5.3" dependencies: - strnum: "npm:^1.0.5" + strnum: "npm:^1.1.1" bin: fxparser: src/cli/cli.js - checksum: 10c0/fdc599b28d6ff64ee3727209387cfbcfaa2c696bc8dca5e218876a6098b8df52c56fa899cc33b3ffc5ffa36de2ebbb308fe6794930b217e80dd5985fcab432bd + checksum: 10c0/bf9ccadacfadc95f6e3f0e7882a380a7f219cf0a6f96575149f02cb62bf44c3b7f0daee75b8ff3847bcfd7fbcb201e402c71045936c265cf6d94b141ec4e9327 languageName: node linkType: hard @@ -15208,7 +15208,7 @@ __metadata: languageName: node linkType: hard -"follow-redirects@npm:^1.0.0, follow-redirects@npm:^1.15.6": +"follow-redirects@npm:^1.0.0, follow-redirects@npm:^1.15.11": version: 1.15.11 resolution: "follow-redirects@npm:1.15.11" peerDependenciesMeta: @@ -15218,16 +15218,6 @@ __metadata: languageName: node linkType: hard -"follow-redirects@npm:^1.14.0": - version: 1.15.6 - resolution: "follow-redirects@npm:1.15.6" - peerDependenciesMeta: - debug: - optional: true - checksum: 10c0/9ff767f0d7be6aa6870c82ac79cf0368cd73e01bbc00e9eb1c2a16fbb198ec105e3c9b6628bb98e9f3ac66fe29a957b9645bcb9a490bb7aa0d35f908b6b85071 - languageName: node - linkType: hard - "for-each@npm:^0.3.3, for-each@npm:^0.3.5": version: 0.3.5 resolution: "for-each@npm:0.3.5" @@ -15270,7 +15260,7 @@ __metadata: languageName: node linkType: hard -"form-data@npm:^4.0.0, form-data@npm:^4.0.4": +"form-data@npm:^4.0.0": version: 4.0.4 resolution: "form-data@npm:4.0.4" dependencies: @@ -15283,6 +15273,19 @@ __metadata: languageName: node linkType: hard +"form-data@npm:^4.0.5": + version: 4.0.5 + resolution: "form-data@npm:4.0.5" + dependencies: + asynckit: "npm:^0.4.0" + combined-stream: "npm:^1.0.8" + es-set-tostringtag: "npm:^2.1.0" + hasown: "npm:^2.0.2" + mime-types: "npm:^2.1.12" + checksum: 10c0/dd6b767ee0bbd6d84039db12a0fa5a2028160ffbfaba1800695713b46ae974a5f6e08b3356c3195137f8530dcd9dfcb5d5ae1eeff53d0db1e5aad863b619ce3b + languageName: node + linkType: hard + "formdata-polyfill@npm:^4.0.10": version: 4.0.10 resolution: "formdata-polyfill@npm:4.0.10" @@ -15374,15 +15377,6 @@ __metadata: languageName: node linkType: hard -"fs-minipass@npm:^2.0.0": - version: 2.1.0 - resolution: "fs-minipass@npm:2.1.0" - dependencies: - minipass: "npm:^3.0.0" - checksum: 10c0/703d16522b8282d7299337539c3ed6edddd1afe82435e4f5b76e34a79cd74e488a8a0e26a636afc2440e1a23b03878e2122e3a2cfe375a5cf63c37d92b86a004 - languageName: node - linkType: hard - "fs-minipass@npm:^3.0.0": version: 3.0.3 resolution: "fs-minipass@npm:3.0.3" @@ -15699,8 +15693,8 @@ __metadata: linkType: hard "glob@npm:^10.2.2, glob@npm:^10.3.10": - version: 10.4.5 - resolution: "glob@npm:10.4.5" + version: 10.5.0 + resolution: "glob@npm:10.5.0" dependencies: foreground-child: "npm:^3.1.0" jackspeak: "npm:^3.1.2" @@ -15710,7 +15704,7 @@ __metadata: path-scurry: "npm:^1.11.1" bin: glob: dist/esm/bin.mjs - checksum: 10c0/19a9759ea77b8e3ca0a43c2f07ecddc2ad46216b786bb8f993c445aee80d345925a21e5280c7b7c6c59e860a0154b84e4b2b60321fea92cd3c56b4a7489f160e + checksum: 10c0/100705eddbde6323e7b35e1d1ac28bcb58322095bd8e63a7d0bef1a2cdafe0d0f7922a981b2b48369a4f8c1b077be5c171804534c3509dfe950dde15fbe6d828 languageName: node linkType: hard @@ -19183,13 +19177,6 @@ __metadata: languageName: node linkType: hard -"lru-cache@npm:^9.1.1 || ^10.0.0": - version: 10.0.1 - resolution: "lru-cache@npm:10.0.1" - checksum: 10c0/982dabfb227b9a2daf56d712ae0e72e01115a28c0a2068cd71277bca04568f3417bbf741c6c7941abc5c620fd8059e34f15607f90ebccbfa0a17533322d27a8e - languageName: node - linkType: hard - "luxon@npm:~3.7.0": version: 3.7.2 resolution: "luxon@npm:3.7.2" @@ -20013,21 +20000,14 @@ __metadata: languageName: node linkType: hard -"minipass@npm:^5.0.0": - version: 5.0.0 - resolution: "minipass@npm:5.0.0" - checksum: 10c0/a91d8043f691796a8ac88df039da19933ef0f633e3d7f0d35dcd5373af49131cf2399bfc355f41515dc495e3990369c3858cd319e5c2722b4753c90bf3152462 - languageName: node - linkType: hard - -"minipass@npm:^5.0.0 || ^6.0.2 || ^7.0.0, minipass@npm:^7.0.2, minipass@npm:^7.0.3, minipass@npm:^7.1.2": +"minipass@npm:^5.0.0 || ^6.0.2 || ^7.0.0, minipass@npm:^7.0.2, minipass@npm:^7.0.3, minipass@npm:^7.0.4, minipass@npm:^7.1.2": version: 7.1.2 resolution: "minipass@npm:7.1.2" checksum: 10c0/b0fd20bb9fb56e5fa9a8bfac539e8915ae07430a619e4b86ff71f5fc757ef3924b23b2c4230393af1eda647ed3d75739e4e0acb250a6b1eb277cf7f8fe449557 languageName: node linkType: hard -"minizlib@npm:^2.1.1, minizlib@npm:^2.1.2": +"minizlib@npm:^2.1.2": version: 2.1.2 resolution: "minizlib@npm:2.1.2" dependencies: @@ -20037,6 +20017,15 @@ __metadata: languageName: node linkType: hard +"minizlib@npm:^3.1.0": + version: 3.1.0 + resolution: "minizlib@npm:3.1.0" + dependencies: + minipass: "npm:^7.1.2" + checksum: 10c0/5aad75ab0090b8266069c9aabe582c021ae53eb33c6c691054a13a45db3b4f91a7fb1bd79151e6b4e9e9a86727b522527c0a06ec7d45206b745d54cd3097bcec + languageName: node + linkType: hard + "mitt@npm:^1.1.3": version: 1.2.0 resolution: "mitt@npm:1.2.0" @@ -20058,15 +20047,6 @@ __metadata: languageName: node linkType: hard -"mkdirp@npm:^1.0.3": - version: 1.0.4 - resolution: "mkdirp@npm:1.0.4" - bin: - mkdirp: bin/cmd.js - checksum: 10c0/46ea0f3ffa8bc6a5bc0c7081ffc3907777f0ed6516888d40a518c5111f8366d97d2678911ad1a6882bf592fa9de6c784fea32e1687bb94e1f4944170af48a5cf - languageName: node - linkType: hard - "module-details-from-path@npm:^1.0.3": version: 1.0.3 resolution: "module-details-from-path@npm:1.0.3" @@ -21331,7 +21311,7 @@ __metadata: languageName: node linkType: hard -"path-scurry@npm:^1.11.1": +"path-scurry@npm:^1.11.1, path-scurry@npm:^1.6.1": version: 1.11.1 resolution: "path-scurry@npm:1.11.1" dependencies: @@ -21341,16 +21321,6 @@ __metadata: languageName: node linkType: hard -"path-scurry@npm:^1.6.1": - version: 1.10.1 - resolution: "path-scurry@npm:1.10.1" - dependencies: - lru-cache: "npm:^9.1.1 || ^10.0.0" - minipass: "npm:^5.0.0 || ^6.0.2 || ^7.0.0" - checksum: 10c0/e5dc78a7348d25eec61ab166317e9e9c7b46818aa2c2b9006c507a6ff48c672d011292d9662527213e558f5652ce0afcc788663a061d8b59ab495681840c0c1e - languageName: node - linkType: hard - "path-to-regexp@npm:^6.2.0": version: 6.2.2 resolution: "path-to-regexp@npm:6.2.2" @@ -24793,10 +24763,10 @@ __metadata: languageName: node linkType: hard -"strnum@npm:^1.0.5": - version: 1.0.5 - resolution: "strnum@npm:1.0.5" - checksum: 10c0/64fb8cc2effbd585a6821faa73ad97d4b553c8927e49086a162ffd2cc818787643390b89d567460a8e74300148d11ac052e21c921ef2049f2987f4b1b89a7ff1 +"strnum@npm:^1.1.1": + version: 1.1.2 + resolution: "strnum@npm:1.1.2" + checksum: 10c0/a0fce2498fa3c64ce64a40dada41beb91cabe3caefa910e467dc0518ef2ebd7e4d10f8c2202a6104f1410254cae245066c0e94e2521fb4061a5cb41831952392 languageName: node linkType: hard @@ -25208,12 +25178,12 @@ __metadata: languageName: node linkType: hard -"systeminformation@npm:5.23.8": - version: 5.23.8 - resolution: "systeminformation@npm:5.23.8" +"systeminformation@npm:^5.24.0": + version: 5.30.7 + resolution: "systeminformation@npm:5.30.7" bin: systeminformation: lib/cli.js - checksum: 10c0/d4d750d82345081a6a12200ec8f559ff65a8c28d9797d4368c246682ee02131ee08a4227e4401b6680839f0f0e1a72758071fd84eae2f0584a89e948d583703f + checksum: 10c0/62588fabe62ec258d56055e609a075fe1eb1da2f090adc8c53e025ad8947d6eb9d3d2889646973fafba9528e06958decbb1def2b989af0363a952c5aff65fbae conditions: (os=darwin | os=linux | os=win32 | os=freebsd | os=openbsd | os=netbsd | os=sunos | os=android) languageName: node linkType: hard @@ -25258,17 +25228,16 @@ __metadata: languageName: node linkType: hard -"tar@npm:^6.1.11, tar@npm:^6.2.1": - version: 6.2.1 - resolution: "tar@npm:6.2.1" +"tar@npm:^7.4.4": + version: 7.5.7 + resolution: "tar@npm:7.5.7" dependencies: - chownr: "npm:^2.0.0" - fs-minipass: "npm:^2.0.0" - minipass: "npm:^5.0.0" - minizlib: "npm:^2.1.1" - mkdirp: "npm:^1.0.3" - yallist: "npm:^4.0.0" - checksum: 10c0/a5eca3eb50bc11552d453488344e6507156b9193efd7635e98e867fab275d527af53d8866e2370cd09dfe74378a18111622ace35af6a608e5223a7d27fe99537 + "@isaacs/fs-minipass": "npm:^4.0.0" + chownr: "npm:^3.0.0" + minipass: "npm:^7.1.2" + minizlib: "npm:^3.1.0" + yallist: "npm:^5.0.0" + checksum: 10c0/51f261afc437e1112c3e7919478d6176ea83f7f7727864d8c2cce10f0b03a631d1911644a567348c3063c45abdae39718ba97abb073d22aa3538b9a53ae1e31c languageName: node linkType: hard @@ -27171,6 +27140,13 @@ __metadata: languageName: node linkType: hard +"yallist@npm:^5.0.0": + version: 5.0.0 + resolution: "yallist@npm:5.0.0" + checksum: 10c0/a499c81ce6d4a1d260d4ea0f6d49ab4da09681e32c3f0472dee16667ed69d01dae63a3b81745a24bd78476ec4fcf856114cb4896ace738e01da34b2c42235416 + languageName: node + linkType: hard + "yaml@npm:2.0.0-1": version: 2.0.0-1 resolution: "yaml@npm:2.0.0-1" From 482b435fd28cdecd0fcbac26b1b6e25e5a4cecef Mon Sep 17 00:00:00 2001 From: Rahul <254529899+motsc@users.noreply.github.com> Date: Tue, 17 Feb 2026 12:37:04 -0800 Subject: [PATCH 2/6] build(deps): upgrade @slack/webhook to v7, remove axios and tar resolutions --- package.json | 2 - packages/api/package.json | 2 +- yarn.lock | 130 ++++++++++++++++++++------------------ 3 files changed, 71 insertions(+), 63 deletions(-) diff --git a/package.json b/package.json index cf83327df8..0663aa0078 100644 --- a/package.json +++ b/package.json @@ -76,8 +76,6 @@ "brace-expansion": "^2.0.2", "diff": "^5.2.2", "on-headers": "^1.1.0", - "tar": "^7.4.4", - "axios": "^1.7.0", "fast-xml-parser": "^4.4.0", "systeminformation": "^5.24.0" } diff --git a/packages/api/package.json b/packages/api/package.json index ef9b8b87e8..5d3f40e504 100644 --- a/packages/api/package.json +++ b/packages/api/package.json @@ -15,7 +15,7 @@ "@opentelemetry/api": "^1.8.0", "@opentelemetry/host-metrics": "^0.35.5", "@opentelemetry/sdk-metrics": "^1.30.1", - "@slack/webhook": "^6.1.0", + "@slack/webhook": "^7.0.0", "@types/node": "^22.15.18", "ai": "5.0.59", "aws4": "^1.13.2", diff --git a/yarn.lock b/yarn.lock index dad899d722..e04f8eb107 100644 --- a/yarn.lock +++ b/yarn.lock @@ -4233,7 +4233,7 @@ __metadata: "@opentelemetry/api": "npm:^1.8.0" "@opentelemetry/host-metrics": "npm:^0.35.5" "@opentelemetry/sdk-metrics": "npm:^1.30.1" - "@slack/webhook": "npm:^6.1.0" + "@slack/webhook": "npm:^7.0.0" "@types/aws4": "npm:^1" "@types/compression": "npm:^1.7.3" "@types/cors": "npm:^2.8.14" @@ -4915,15 +4915,6 @@ __metadata: languageName: node linkType: hard -"@isaacs/fs-minipass@npm:^4.0.0": - version: 4.0.1 - resolution: "@isaacs/fs-minipass@npm:4.0.1" - dependencies: - minipass: "npm:^7.0.4" - checksum: 10c0/c25b6dc1598790d5b55c0947a9b7d111cfa92594db5296c3b907e2f533c033666f692a3939eadac17b1c7c40d362d0b0635dc874cbfe3e70db7c2b07cc97a5d2 - languageName: node - linkType: hard - "@istanbuljs/load-nyc-config@npm:^1.0.0": version: 1.1.0 resolution: "@istanbuljs/load-nyc-config@npm:1.1.0" @@ -8036,21 +8027,21 @@ __metadata: languageName: node linkType: hard -"@slack/types@npm:^1.2.1": - version: 1.10.0 - resolution: "@slack/types@npm:1.10.0" - checksum: 10c0/786565b85c67d547dfbb581d8a0d78de34a8e118cbd5d96c522a0397d690282f576a3d048c2eed3736227e99ab0bec200896293af4051bbbe470cc5237e7e1c8 +"@slack/types@npm:^2.9.0": + version: 2.20.0 + resolution: "@slack/types@npm:2.20.0" + checksum: 10c0/61187bf849eb23d00e0fefeee4525b5dc6e17fb961eb9a12a519ba12ae05cd13cd40e93cb2ce5288c981d9f166dc694816f50d8e71d12d98942a789c83626d25 languageName: node linkType: hard -"@slack/webhook@npm:^6.1.0": - version: 6.1.0 - resolution: "@slack/webhook@npm:6.1.0" +"@slack/webhook@npm:^7.0.0": + version: 7.0.7 + resolution: "@slack/webhook@npm:7.0.7" dependencies: - "@slack/types": "npm:^1.2.1" - "@types/node": "npm:>=12.0.0" - axios: "npm:^0.21.4" - checksum: 10c0/46a2ce96cf80730ae76c406dd12e55a057a4243c26e0afb9ecd6bdda3a48be96356dfb5e179402078c2c694c1c5086f2ed5534ac271e4127d35c3062fa0eff23 + "@slack/types": "npm:^2.9.0" + "@types/node": "npm:>=18.0.0" + axios: "npm:^1.13.5" + checksum: 10c0/df355ffbc4f99c00a18d6bca8269be9fa70e39d43b51768c94194fc7475ea13c79e9b7ad6b3ffb2acd2873e67690c662eda724b12bfd2fe51b34215811d762b3 languageName: node linkType: hard @@ -9178,13 +9169,6 @@ __metadata: languageName: node linkType: hard -"@types/node@npm:>=12.0.0": - version: 20.6.0 - resolution: "@types/node@npm:20.6.0" - checksum: 10c0/0979a218f1862a80ddb7a8ba70498798a72e4861394244657c47bd64ed0c87baa4e0c8ce693bab23e58ec272913438b341de98768dc737491c58e6faff19d955 - languageName: node - linkType: hard - "@types/node@npm:>=12.12.47": version: 20.2.1 resolution: "@types/node@npm:20.2.1" @@ -9199,6 +9183,15 @@ __metadata: languageName: node linkType: hard +"@types/node@npm:>=18.0.0": + version: 25.2.3 + resolution: "@types/node@npm:25.2.3" + dependencies: + undici-types: "npm:~7.16.0" + checksum: 10c0/925833029ce0bb4a72c36f90b93287184d3511aeb0fa60a994ae94b5430c22f9be6693d67d210df79267cb54c6f6978caaefb149d99ab5f83af5827ba7cb9822 + languageName: node + linkType: hard + "@types/node@npm:^12.7.1": version: 12.20.55 resolution: "@types/node@npm:12.20.55" @@ -10866,7 +10859,7 @@ __metadata: languageName: node linkType: hard -"axios@npm:^1.7.0": +"axios@npm:^1.13.5, axios@npm:^1.8.3": version: 1.13.5 resolution: "axios@npm:1.13.5" dependencies: @@ -11783,10 +11776,10 @@ __metadata: languageName: node linkType: hard -"chownr@npm:^3.0.0": - version: 3.0.0 - resolution: "chownr@npm:3.0.0" - checksum: 10c0/43925b87700f7e3893296c8e9c56cc58f926411cce3a6e5898136daaf08f08b9a8eb76d37d3267e707d0dcc17aed2e2ebdf5848c0c3ce95cf910a919935c1b10 +"chownr@npm:^2.0.0": + version: 2.0.0 + resolution: "chownr@npm:2.0.0" + checksum: 10c0/594754e1303672171cc04e50f6c398ae16128eb134a88f801bf5354fd96f205320f23536a045d9abd8b51024a149696e51231565891d4efdab8846021ecf88e6 languageName: node linkType: hard @@ -15377,6 +15370,15 @@ __metadata: languageName: node linkType: hard +"fs-minipass@npm:^2.0.0": + version: 2.1.0 + resolution: "fs-minipass@npm:2.1.0" + dependencies: + minipass: "npm:^3.0.0" + checksum: 10c0/703d16522b8282d7299337539c3ed6edddd1afe82435e4f5b76e34a79cd74e488a8a0e26a636afc2440e1a23b03878e2122e3a2cfe375a5cf63c37d92b86a004 + languageName: node + linkType: hard + "fs-minipass@npm:^3.0.0": version: 3.0.3 resolution: "fs-minipass@npm:3.0.3" @@ -20000,14 +20002,21 @@ __metadata: languageName: node linkType: hard -"minipass@npm:^5.0.0 || ^6.0.2 || ^7.0.0, minipass@npm:^7.0.2, minipass@npm:^7.0.3, minipass@npm:^7.0.4, minipass@npm:^7.1.2": +"minipass@npm:^5.0.0": + version: 5.0.0 + resolution: "minipass@npm:5.0.0" + checksum: 10c0/a91d8043f691796a8ac88df039da19933ef0f633e3d7f0d35dcd5373af49131cf2399bfc355f41515dc495e3990369c3858cd319e5c2722b4753c90bf3152462 + languageName: node + linkType: hard + +"minipass@npm:^5.0.0 || ^6.0.2 || ^7.0.0, minipass@npm:^7.0.2, minipass@npm:^7.0.3, minipass@npm:^7.1.2": version: 7.1.2 resolution: "minipass@npm:7.1.2" checksum: 10c0/b0fd20bb9fb56e5fa9a8bfac539e8915ae07430a619e4b86ff71f5fc757ef3924b23b2c4230393af1eda647ed3d75739e4e0acb250a6b1eb277cf7f8fe449557 languageName: node linkType: hard -"minizlib@npm:^2.1.2": +"minizlib@npm:^2.1.1, minizlib@npm:^2.1.2": version: 2.1.2 resolution: "minizlib@npm:2.1.2" dependencies: @@ -20017,15 +20026,6 @@ __metadata: languageName: node linkType: hard -"minizlib@npm:^3.1.0": - version: 3.1.0 - resolution: "minizlib@npm:3.1.0" - dependencies: - minipass: "npm:^7.1.2" - checksum: 10c0/5aad75ab0090b8266069c9aabe582c021ae53eb33c6c691054a13a45db3b4f91a7fb1bd79151e6b4e9e9a86727b522527c0a06ec7d45206b745d54cd3097bcec - languageName: node - linkType: hard - "mitt@npm:^1.1.3": version: 1.2.0 resolution: "mitt@npm:1.2.0" @@ -20047,6 +20047,15 @@ __metadata: languageName: node linkType: hard +"mkdirp@npm:^1.0.3": + version: 1.0.4 + resolution: "mkdirp@npm:1.0.4" + bin: + mkdirp: bin/cmd.js + checksum: 10c0/46ea0f3ffa8bc6a5bc0c7081ffc3907777f0ed6516888d40a518c5111f8366d97d2678911ad1a6882bf592fa9de6c784fea32e1687bb94e1f4944170af48a5cf + languageName: node + linkType: hard + "module-details-from-path@npm:^1.0.3": version: 1.0.3 resolution: "module-details-from-path@npm:1.0.3" @@ -25228,16 +25237,17 @@ __metadata: languageName: node linkType: hard -"tar@npm:^7.4.4": - version: 7.5.7 - resolution: "tar@npm:7.5.7" +"tar@npm:^6.1.11, tar@npm:^6.2.1": + version: 6.2.1 + resolution: "tar@npm:6.2.1" dependencies: - "@isaacs/fs-minipass": "npm:^4.0.0" - chownr: "npm:^3.0.0" - minipass: "npm:^7.1.2" - minizlib: "npm:^3.1.0" - yallist: "npm:^5.0.0" - checksum: 10c0/51f261afc437e1112c3e7919478d6176ea83f7f7727864d8c2cce10f0b03a631d1911644a567348c3063c45abdae39718ba97abb073d22aa3538b9a53ae1e31c + chownr: "npm:^2.0.0" + fs-minipass: "npm:^2.0.0" + minipass: "npm:^5.0.0" + minizlib: "npm:^2.1.1" + mkdirp: "npm:^1.0.3" + yallist: "npm:^4.0.0" + checksum: 10c0/a5eca3eb50bc11552d453488344e6507156b9193efd7635e98e867fab275d527af53d8866e2370cd09dfe74378a18111622ace35af6a608e5223a7d27fe99537 languageName: node linkType: hard @@ -26090,6 +26100,13 @@ __metadata: languageName: node linkType: hard +"undici-types@npm:~7.16.0": + version: 7.16.0 + resolution: "undici-types@npm:7.16.0" + checksum: 10c0/3033e2f2b5c9f1504bdc5934646cb54e37ecaca0f9249c983f7b1fc2e87c6d18399ebb05dc7fd5419e02b2e915f734d872a65da2e3eeed1813951c427d33cc9a + languageName: node + linkType: hard + "unicode-canonical-property-names-ecmascript@npm:^2.0.0": version: 2.0.0 resolution: "unicode-canonical-property-names-ecmascript@npm:2.0.0" @@ -27140,13 +27157,6 @@ __metadata: languageName: node linkType: hard -"yallist@npm:^5.0.0": - version: 5.0.0 - resolution: "yallist@npm:5.0.0" - checksum: 10c0/a499c81ce6d4a1d260d4ea0f6d49ab4da09681e32c3f0472dee16667ed69d01dae63a3b81745a24bd78476ec4fcf856114cb4896ace738e01da34b2c42235416 - languageName: node - linkType: hard - "yaml@npm:2.0.0-1": version: 2.0.0-1 resolution: "yaml@npm:2.0.0-1" From 4cf3c6f8b7497eb0f059dc44952524b5c521ec0f Mon Sep 17 00:00:00 2001 From: Rahul <254529899+motsc@users.noreply.github.com> Date: Tue, 17 Feb 2026 17:11:56 -0800 Subject: [PATCH 3/6] build(security): Docker Scout Tier 1 improvements for clickstack images Strip npm/yarn from production images (~15-20 CVEs removed): - Add concurrently to @hyperdx/api dependencies so entry scripts can use ./node_modules/.bin/concurrently instead of a global install - Remove npm, npx, corepack, yarn, yarnpkg binaries and modules from both prod and all-in-one-base stages (unused at runtime) Update curl and busybox in all-in-one image (~7 CVEs removed): - Upgrade curl and busybox via apk --upgrade in the MongoDB RUN block Add VEX exceptions for OpenSSL 1.1.1k (~55 CVEs suppressed): - New .vex/openssl-mongodb.vex.json marks 20 OpenSSL CVEs as not_affected (MongoDB is localhost-only, no external TLS cert processing); reference via: docker scout cves --vex-location /etc/vex/ - Copy VEX files into image at /etc/vex/ Add supply chain attestations to release builds (+15 policy points): - Replace --squash with --sbom=true --provenance=true on all 6 docker buildx build release targets in Makefile - --squash is incompatible with attestation flags; multi-stage build already minimizes layers Drop app process privileges via su-exec in all-in-one: - Install su-exec in all-in-one-base stage - Run HyperDX app via su-exec otel in entry.local.base.sh; system services (ClickHouse, MongoDB, OTel) continue as root - chown /app to otel user so the app process has full file access --- .vex/openssl-mongodb.vex.json | 150 +++++++++++++++++++++++++++++ Makefile | 12 +-- docker/hyperdx/Dockerfile | 25 +++-- docker/hyperdx/entry.local.base.sh | 4 +- docker/hyperdx/entry.prod.sh | 2 +- packages/api/package.json | 1 + 6 files changed, 176 insertions(+), 18 deletions(-) create mode 100644 .vex/openssl-mongodb.vex.json diff --git a/.vex/openssl-mongodb.vex.json b/.vex/openssl-mongodb.vex.json new file mode 100644 index 0000000000..20e3a67fd3 --- /dev/null +++ b/.vex/openssl-mongodb.vex.json @@ -0,0 +1,150 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://github.com/hyperdxio/hyperdx/blob/main/.vex/openssl-mongodb.vex.json", + "author": "HyperDX Team", + "role": "Supplier", + "timestamp": "2026-02-17T00:00:00Z", + "version": 1, + "statements": [ + { + "vulnerability": { "name": "CVE-2021-3711" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. OpenSSL certificate-parsing vulnerabilities are not exploitable in this deployment." + }, + { + "vulnerability": { "name": "CVE-2021-3712" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. OpenSSL certificate-parsing vulnerabilities are not exploitable in this deployment." + }, + { + "vulnerability": { "name": "CVE-2021-4044" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. OpenSSL vulnerabilities are not exploitable in this deployment." + }, + { + "vulnerability": { "name": "CVE-2022-0778" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode. Certificate processing from untrusted sources does not occur, making this infinite-loop vulnerability unexploitable." + }, + { + "vulnerability": { "name": "CVE-2022-1473" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This memory leak vulnerability is not exploitable in this deployment." + }, + { + "vulnerability": { "name": "CVE-2022-3358" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode. Custom cipher usage from untrusted sources does not occur in this deployment." + }, + { + "vulnerability": { "name": "CVE-2022-3602" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This buffer overflow vulnerability is not exploitable in this deployment." + }, + { + "vulnerability": { "name": "CVE-2022-3786" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This buffer overflow vulnerability is not exploitable in this deployment." + }, + { + "vulnerability": { "name": "CVE-2022-3996" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode. The double-locking issue is not triggerable via external input in this deployment." + }, + { + "vulnerability": { "name": "CVE-2023-0286" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode. External GeneralName certificate parsing does not occur in this deployment." + }, + { + "vulnerability": { "name": "CVE-2023-0464" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode. Untrusted X.509 certificate chains with policy constraints are not processed in this deployment." + }, + { + "vulnerability": { "name": "CVE-2023-5363" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode. Untrusted key/IV inputs from external sources are not processed in this deployment." + }, + { + "vulnerability": { "name": "CVE-2024-4741" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This use-after-free vulnerability is not exploitable in this deployment." + }, + { + "vulnerability": { "name": "CVE-2024-5535" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode. The SSL_select_next_proto vulnerability requires attacker-controlled input not present in this deployment." + }, + { + "vulnerability": { "name": "CVE-2024-6119" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode. OCSP responses from external sources are not processed in this deployment." + }, + { + "vulnerability": { "name": "CVE-2025-9230" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment." + }, + { + "vulnerability": { "name": "CVE-2025-15467" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment." + }, + { + "vulnerability": { "name": "CVE-2025-69419" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment." + }, + { + "vulnerability": { "name": "CVE-2025-69420" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment." + }, + { + "vulnerability": { "name": "CVE-2025-69421" }, + "products": [{ "@id": "pkg:oci/clickstack" }], + "status": "not_affected", + "justification": "inline_mitigations_already_exist", + "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment." + } + ] +} diff --git a/Makefile b/Makefile index 4eb94df7db..3edf33159e 100644 --- a/Makefile +++ b/Makefile @@ -203,7 +203,7 @@ release-local: echo "Tag ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} already exists. Skipping push."; \ else \ echo "Tag ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} does not exist. Building and pushing..."; \ - docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \ + docker buildx build --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ --build-context clickhouse=./docker/clickhouse \ --build-context otel-collector=./docker/otel-collector \ --build-context hyperdx=./docker/hyperdx \ @@ -230,7 +230,7 @@ release-all-in-one: echo "Tag ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} already exists. Skipping push."; \ else \ echo "Tag ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} does not exist. Building and pushing..."; \ - docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \ + docker buildx build --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ --build-context clickhouse=./docker/clickhouse \ --build-context otel-collector=./docker/otel-collector \ --build-context hyperdx=./docker/hyperdx \ @@ -257,7 +257,7 @@ release-app: echo "Tag ${IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} already exists. Skipping push."; \ else \ echo "Tag ${IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} does not exist. Building and pushing..."; \ - docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \ + docker buildx build --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ --build-context hyperdx=./docker/hyperdx \ --build-context api=./packages/api \ --build-context app=./packages/app \ @@ -286,7 +286,7 @@ release-otel-collector-nightly: .PHONY: release-app-nightly release-app-nightly: @echo "Building and pushing nightly tag ${IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG}..."; \ - docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \ + docker buildx build --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ --build-context hyperdx=./docker/hyperdx \ --build-context api=./packages/api \ --build-context app=./packages/app \ @@ -301,7 +301,7 @@ release-app-nightly: .PHONY: release-local-nightly release-local-nightly: @echo "Building and pushing nightly tag ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG}..."; \ - docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \ + docker buildx build --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ --build-context clickhouse=./docker/clickhouse \ --build-context otel-collector=./docker/otel-collector \ --build-context hyperdx=./docker/hyperdx \ @@ -319,7 +319,7 @@ release-local-nightly: .PHONY: release-all-in-one-nightly release-all-in-one-nightly: @echo "Building and pushing nightly tag ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG}..."; \ - docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \ + docker buildx build --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ --build-context clickhouse=./docker/clickhouse \ --build-context otel-collector=./docker/otel-collector \ --build-context hyperdx=./docker/hyperdx \ diff --git a/docker/hyperdx/Dockerfile b/docker/hyperdx/Dockerfile index 53c37eb435..cb2079fae0 100644 --- a/docker/hyperdx/Dockerfile +++ b/docker/hyperdx/Dockerfile @@ -76,8 +76,10 @@ ARG CODE_VERSION ENV CODE_VERSION=$CODE_VERSION ENV NODE_ENV=production -# Install libs used for the start script -RUN npm install -g concurrently@9.1.0 +# Remove package managers from production image (not needed at runtime) +RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack \ + /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack \ + /usr/local/bin/yarn /usr/local/bin/yarnpkg USER node @@ -118,9 +120,6 @@ COPY --from=node_base --link /usr/local/lib /usr/local/lib COPY --from=node_base /usr/lib /usr/lib COPY --from=node_base /usr/local/include /usr/local/include -# Install libs used for the start script -RUN npm install -g concurrently@9.1.0 - # Set up Clickhouse COPY --from=clickhouse ./local/*.xml /etc/clickhouse-server COPY --from=hyperdx ./clickhouseConfig.xml /etc/clickhouse-server/config.xml @@ -146,19 +145,27 @@ COPY --from=migrate-builder /migrate /usr/local/bin/migrate RUN echo 'http://dl-cdn.alpinelinux.org/alpine/v3.9/main' >> /etc/apk/repositories && \ echo 'http://dl-cdn.alpinelinux.org/alpine/v3.9/community' >> /etc/apk/repositories && \ apk update && \ - apk add --no-cache mongodb yaml-cpp=0.6.2-r2 curl ca-certificates && \ + apk add --no-cache mongodb yaml-cpp=0.6.2-r2 ca-certificates su-exec && \ + apk add --no-cache --upgrade curl busybox && \ addgroup -S -g ${USER_GID} otel && \ adduser -S -u ${USER_UID} -G otel otel && \ mkdir -p /data/db && \ install -d -m 0777 -o ${USER_UID} -g ${USER_GID} /etc/otel/supervisor-data && \ - rm -rf /var/cache/apk/* + rm -rf /var/cache/apk/* && \ + rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack \ + /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack \ + /usr/local/bin/yarn /usr/local/bin/yarnpkg ENV NODE_ENV=production -# Set up App (copy from prod stage) -COPY --from=prod /app /app +# Set up App (copy from prod stage, chown to otel so su-exec otel can write if needed) +COPY --from=prod --chown=${USER_UID}:${USER_GID} /app /app COPY --from=hyperdx ./entry.local.base.sh /etc/local/entry.base.sh +# Copy VEX exception files for Docker Scout vulnerability suppression +# Reference via: docker scout cves --vex-location /etc/vex/ +COPY .vex/*.vex.json /etc/vex/ + WORKDIR /app # Add hosts entry in entrypoint script instead of here diff --git a/docker/hyperdx/entry.local.base.sh b/docker/hyperdx/entry.local.base.sh index f347afd0be..1fbaa8e9da 100644 --- a/docker/hyperdx/entry.local.base.sh +++ b/docker/hyperdx/entry.local.base.sh @@ -66,8 +66,8 @@ echo "ClickHouse is ready!" # Start Otel Collector with entrypoint script for template rendering and log rotation /otel-entrypoint.sh /usr/local/bin/opampsupervisor > /var/log/otel-collector.log 2>&1 & -# Start HyperDX app -concurrently \ +# Start HyperDX app (run as otel user via su-exec) +su-exec otel ./node_modules/.bin/concurrently \ "--kill-others-on-fail" \ "--names=API,APP,ALERT-TASK" \ "PORT=${HYPERDX_API_PORT:-8000} HYPERDX_APP_PORT=${HYPERDX_APP_PORT:-8080} node -r ./node_modules/@hyperdx/node-opentelemetry/build/src/tracing ./packages/api/build/index.js" \ diff --git a/docker/hyperdx/entry.prod.sh b/docker/hyperdx/entry.prod.sh index 64c7c4fc45..a34fea2025 100644 --- a/docker/hyperdx/entry.prod.sh +++ b/docker/hyperdx/entry.prod.sh @@ -13,7 +13,7 @@ echo "Visit the HyperDX UI at $FRONTEND_URL" echo "" # Use concurrently to run both the API and App servers -concurrently \ +./node_modules/.bin/concurrently \ "--kill-others-on-fail" \ "--names=API,APP,ALERT-TASK" \ "PORT=${HYPERDX_API_PORT:-8000} HYPERDX_APP_PORT=${HYPERDX_APP_PORT:-8080} node -r ./node_modules/@hyperdx/node-opentelemetry/build/src/tracing ./packages/api/build/index.js" \ diff --git a/packages/api/package.json b/packages/api/package.json index 5d3f40e504..84e1cd0a6e 100644 --- a/packages/api/package.json +++ b/packages/api/package.json @@ -21,6 +21,7 @@ "aws4": "^1.13.2", "chrono-node": "^2.9.0", "compression": "^1.7.4", + "concurrently": "^9.1.2", "connect-mongo": "^4.6.0", "cors": "^2.8.5", "cron": "^4.3.1", From 95b2261658924c6749acf5af49e2d6765df452ee Mon Sep 17 00:00:00 2001 From: Rahul <254529899+motsc@users.noreply.github.com> Date: Wed, 18 Feb 2026 07:07:53 -0800 Subject: [PATCH 4/6] build(deps): update yarn.lock for concurrently in @hyperdx/api dependencies --- yarn.lock | 1 + 1 file changed, 1 insertion(+) diff --git a/yarn.lock b/yarn.lock index e04f8eb107..aa3e5d3159 100644 --- a/yarn.lock +++ b/yarn.lock @@ -4253,6 +4253,7 @@ __metadata: aws4: "npm:^1.13.2" chrono-node: "npm:^2.9.0" compression: "npm:^1.7.4" + concurrently: "npm:^9.1.2" connect-mongo: "npm:^4.6.0" cors: "npm:^2.8.5" cron: "npm:^4.3.1" From eaffa081f1deb06b6dff360e261deb25023832c4 Mon Sep 17 00:00:00 2001 From: Rahul <254529899+motsc@users.noreply.github.com> Date: Tue, 24 Feb 2026 17:13:27 -0800 Subject: [PATCH 5/6] fix: address PR #1740 review comments on Makefile and Dockerfile - Restore --squash flag to all 6 release targets in Makefile (was accidentally dropped when --sbom/--provenance were added) - Revert su-exec otel privilege drop in all-in-one entry script; the otel user is the collector's user, not the app's user, and all other services in the all-in-one image run as root anyway - Remove su-exec from Dockerfile apk add (no longer needed) - Revert COPY --chown for /app in all-in-one-base stage --- Makefile | 12 ++++++------ docker/hyperdx/Dockerfile | 6 +++--- docker/hyperdx/entry.local.base.sh | 4 ++-- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/Makefile b/Makefile index 3edf33159e..5b863528f5 100644 --- a/Makefile +++ b/Makefile @@ -203,7 +203,7 @@ release-local: echo "Tag ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} already exists. Skipping push."; \ else \ echo "Tag ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} does not exist. Building and pushing..."; \ - docker buildx build --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ + docker buildx build --squash --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ --build-context clickhouse=./docker/clickhouse \ --build-context otel-collector=./docker/otel-collector \ --build-context hyperdx=./docker/hyperdx \ @@ -230,7 +230,7 @@ release-all-in-one: echo "Tag ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} already exists. Skipping push."; \ else \ echo "Tag ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} does not exist. Building and pushing..."; \ - docker buildx build --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ + docker buildx build --squash --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ --build-context clickhouse=./docker/clickhouse \ --build-context otel-collector=./docker/otel-collector \ --build-context hyperdx=./docker/hyperdx \ @@ -257,7 +257,7 @@ release-app: echo "Tag ${IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} already exists. Skipping push."; \ else \ echo "Tag ${IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} does not exist. Building and pushing..."; \ - docker buildx build --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ + docker buildx build --squash --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ --build-context hyperdx=./docker/hyperdx \ --build-context api=./packages/api \ --build-context app=./packages/app \ @@ -286,7 +286,7 @@ release-otel-collector-nightly: .PHONY: release-app-nightly release-app-nightly: @echo "Building and pushing nightly tag ${IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG}..."; \ - docker buildx build --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ + docker buildx build --squash --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ --build-context hyperdx=./docker/hyperdx \ --build-context api=./packages/api \ --build-context app=./packages/app \ @@ -301,7 +301,7 @@ release-app-nightly: .PHONY: release-local-nightly release-local-nightly: @echo "Building and pushing nightly tag ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG}..."; \ - docker buildx build --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ + docker buildx build --squash --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ --build-context clickhouse=./docker/clickhouse \ --build-context otel-collector=./docker/otel-collector \ --build-context hyperdx=./docker/hyperdx \ @@ -319,7 +319,7 @@ release-local-nightly: .PHONY: release-all-in-one-nightly release-all-in-one-nightly: @echo "Building and pushing nightly tag ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG}..."; \ - docker buildx build --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ + docker buildx build --squash --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \ --build-context clickhouse=./docker/clickhouse \ --build-context otel-collector=./docker/otel-collector \ --build-context hyperdx=./docker/hyperdx \ diff --git a/docker/hyperdx/Dockerfile b/docker/hyperdx/Dockerfile index fab2cd979d..9aca3cc700 100644 --- a/docker/hyperdx/Dockerfile +++ b/docker/hyperdx/Dockerfile @@ -145,7 +145,7 @@ COPY --from=migrate-builder /migrate /usr/local/bin/migrate RUN echo 'http://dl-cdn.alpinelinux.org/alpine/v3.9/main' >> /etc/apk/repositories && \ echo 'http://dl-cdn.alpinelinux.org/alpine/v3.9/community' >> /etc/apk/repositories && \ apk update && \ - apk add --no-cache mongodb yaml-cpp=0.6.2-r2 ca-certificates su-exec && \ + apk add --no-cache mongodb yaml-cpp=0.6.2-r2 ca-certificates && \ apk add --no-cache --upgrade curl busybox && \ addgroup -S -g ${USER_GID} otel && \ adduser -S -u ${USER_UID} -G otel otel && \ @@ -158,8 +158,8 @@ RUN echo 'http://dl-cdn.alpinelinux.org/alpine/v3.9/main' >> /etc/apk/repositori ENV NODE_ENV=production -# Set up App (copy from prod stage, chown to otel so su-exec otel can write if needed) -COPY --from=prod --chown=${USER_UID}:${USER_GID} /app /app +# Set up App +COPY --from=prod /app /app COPY --from=hyperdx ./entry.local.base.sh /etc/local/entry.base.sh # Copy VEX exception files for Docker Scout vulnerability suppression diff --git a/docker/hyperdx/entry.local.base.sh b/docker/hyperdx/entry.local.base.sh index 1fbaa8e9da..d7b7a068b1 100644 --- a/docker/hyperdx/entry.local.base.sh +++ b/docker/hyperdx/entry.local.base.sh @@ -66,8 +66,8 @@ echo "ClickHouse is ready!" # Start Otel Collector with entrypoint script for template rendering and log rotation /otel-entrypoint.sh /usr/local/bin/opampsupervisor > /var/log/otel-collector.log 2>&1 & -# Start HyperDX app (run as otel user via su-exec) -su-exec otel ./node_modules/.bin/concurrently \ +# Start HyperDX app +./node_modules/.bin/concurrently \ "--kill-others-on-fail" \ "--names=API,APP,ALERT-TASK" \ "PORT=${HYPERDX_API_PORT:-8000} HYPERDX_APP_PORT=${HYPERDX_APP_PORT:-8080} node -r ./node_modules/@hyperdx/node-opentelemetry/build/src/tracing ./packages/api/build/index.js" \ From 9bf52f4e1f294dc3276152580109ee5096e9f251 Mon Sep 17 00:00:00 2001 From: Rahul <254529899+motsc@users.noreply.github.com> Date: Wed, 25 Feb 2026 15:01:58 -0600 Subject: [PATCH 6/6] fix(e2e): use .first() on recharts locator in ChartEditorComponent Strict mode violation: when chart editor modal opens over a dashboard, page.locator('.recharts-responsive-container') matches 2 elements -- the modal preview chart AND the tile behind it. Playwright's strict mode requires a single match for .waitFor(). Use .first() consistent with SearchPage.ts which already handles this locator the same way. --- packages/app/tests/e2e/components/ChartEditorComponent.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/packages/app/tests/e2e/components/ChartEditorComponent.ts b/packages/app/tests/e2e/components/ChartEditorComponent.ts index 0d44f5793a..3576fcb8cc 100644 --- a/packages/app/tests/e2e/components/ChartEditorComponent.ts +++ b/packages/app/tests/e2e/components/ChartEditorComponent.ts @@ -86,6 +86,7 @@ export class ChartEditorComponent { // need to wait for the recharts graph to render await this.page .locator('.recharts-responsive-container') + .first() .waitFor({ state: 'visible', timeout: 10000 }); }