build(deps): add security resolutions for vulnerable npm packages

.vex/openssl-mongodb.vex.json

@@ -0,0 +1,150 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://github.com/hyperdxio/hyperdx/blob/main/.vex/openssl-mongodb.vex.json",
+  "author": "HyperDX Team",
+  "role": "Supplier",
+  "timestamp": "2026-02-17T00:00:00Z",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": { "name": "CVE-2021-3711" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. OpenSSL certificate-parsing vulnerabilities are not exploitable in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2021-3712" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. OpenSSL certificate-parsing vulnerabilities are not exploitable in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2021-4044" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. OpenSSL vulnerabilities are not exploitable in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2022-0778" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode. Certificate processing from untrusted sources does not occur, making this infinite-loop vulnerability unexploitable."
+    },
+    {
+      "vulnerability": { "name": "CVE-2022-1473" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This memory leak vulnerability is not exploitable in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2022-3358" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode. Custom cipher usage from untrusted sources does not occur in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2022-3602" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This buffer overflow vulnerability is not exploitable in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2022-3786" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This buffer overflow vulnerability is not exploitable in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2022-3996" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode. The double-locking issue is not triggerable via external input in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2023-0286" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode. External GeneralName certificate parsing does not occur in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2023-0464" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode. Untrusted X.509 certificate chains with policy constraints are not processed in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2023-5363" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode. Untrusted key/IV inputs from external sources are not processed in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2024-4741" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This use-after-free vulnerability is not exploitable in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2024-5535" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode. The SSL_select_next_proto vulnerability requires attacker-controlled input not present in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2024-6119" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode. OCSP responses from external sources are not processed in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2025-9230" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2025-15467" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2025-69419" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2025-69420" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2025-69421" },
+      "products": [{ "@id": "pkg:oci/clickstack" }],
+      "status": "not_affected",
+      "justification": "inline_mitigations_already_exist",
+      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment."
+    }
+  ]
+}

Makefile

@@ -203,7 +203,7 @@ release-local:
 		echo "Tag ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} already exists. Skipping push."; \
 	else \
 		echo "Tag ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} does not exist. Building and pushing..."; \
-		docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
+		docker buildx build --squash --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \
 			--build-context clickhouse=./docker/clickhouse \
 			--build-context otel-collector=./docker/otel-collector \
 			--build-context hyperdx=./docker/hyperdx \
@@ -230,7 +230,7 @@ release-all-in-one:
 		echo "Tag ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} already exists. Skipping push."; \
 	else \
 		echo "Tag ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} does not exist. Building and pushing..."; \
-		docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
+		docker buildx build --squash --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \
 			--build-context clickhouse=./docker/clickhouse \
 			--build-context otel-collector=./docker/otel-collector \
 			--build-context hyperdx=./docker/hyperdx \
@@ -257,7 +257,7 @@ release-app:
 		echo "Tag ${IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} already exists. Skipping push."; \
 	else \
 		echo "Tag ${IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} does not exist. Building and pushing..."; \
-		docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
+		docker buildx build --squash --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \
 			--build-context hyperdx=./docker/hyperdx \
 			--build-context api=./packages/api \
 			--build-context app=./packages/app \
@@ -286,7 +286,7 @@ release-otel-collector-nightly:
 .PHONY: release-app-nightly
 release-app-nightly:
 	@echo "Building and pushing nightly tag ${IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG}..."; \
-	docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
+	docker buildx build --squash --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \
 		--build-context hyperdx=./docker/hyperdx \
 		--build-context api=./packages/api \
 		--build-context app=./packages/app \
@@ -301,7 +301,7 @@ release-app-nightly:
 .PHONY: release-local-nightly
 release-local-nightly:
 	@echo "Building and pushing nightly tag ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG}..."; \
-	docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
+	docker buildx build --squash --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \
 		--build-context clickhouse=./docker/clickhouse \
 		--build-context otel-collector=./docker/otel-collector \
 		--build-context hyperdx=./docker/hyperdx \
@@ -319,7 +319,7 @@ release-local-nightly:
 .PHONY: release-all-in-one-nightly
 release-all-in-one-nightly:
 	@echo "Building and pushing nightly tag ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG}..."; \
-	docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
+	docker buildx build --squash --sbom=true --provenance=true . -f ./docker/hyperdx/Dockerfile \
 		--build-context clickhouse=./docker/clickhouse \
 		--build-context otel-collector=./docker/otel-collector \
 		--build-context hyperdx=./docker/hyperdx \

docker/hyperdx/Dockerfile

@@ -76,8 +76,10 @@ ARG CODE_VERSION
 ENV CODE_VERSION=$CODE_VERSION
 ENV NODE_ENV=production
 
-# Install libs used for the start script
-RUN npm install -g concurrently@9.1.0
+# Remove package managers from production image (not needed at runtime)
+RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack \
+    /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack \
+    /usr/local/bin/yarn /usr/local/bin/yarnpkg
 
 USER node
 
@@ -118,9 +120,6 @@ COPY --from=node_base --link /usr/local/lib /usr/local/lib
 COPY --from=node_base /usr/lib /usr/lib
 COPY --from=node_base /usr/local/include /usr/local/include
 
-# Install libs used for the start script
-RUN npm install -g concurrently@9.1.0
-
 # Set up Clickhouse
 COPY --from=clickhouse ./local/*.xml /etc/clickhouse-server
 COPY --from=hyperdx ./clickhouseConfig.xml /etc/clickhouse-server/config.xml
@@ -146,19 +145,27 @@ COPY --from=migrate-builder /migrate /usr/local/bin/migrate
 RUN echo 'http://dl-cdn.alpinelinux.org/alpine/v3.9/main' >> /etc/apk/repositories && \
   echo 'http://dl-cdn.alpinelinux.org/alpine/v3.9/community' >> /etc/apk/repositories && \
   apk update && \
-  apk add --no-cache mongodb yaml-cpp=0.6.2-r2 curl ca-certificates && \
+  apk add --no-cache mongodb yaml-cpp=0.6.2-r2 ca-certificates && \
+  apk add --no-cache --upgrade curl busybox && \
   addgroup -S -g ${USER_GID} otel && \
   adduser  -S -u ${USER_UID} -G otel otel && \
   mkdir -p /data/db && \
   install -d -m 0777 -o ${USER_UID} -g ${USER_GID} /etc/otel/supervisor-data && \
-  rm -rf /var/cache/apk/*
+  rm -rf /var/cache/apk/* && \
+  rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack \
+    /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack \
+    /usr/local/bin/yarn /usr/local/bin/yarnpkg
 
 ENV NODE_ENV=production
 
-# Set up App (copy from prod stage)
+# Set up App
 COPY --from=prod /app /app
 COPY --from=hyperdx ./entry.local.base.sh /etc/local/entry.base.sh
 
+# Copy VEX exception files for Docker Scout vulnerability suppression
+# Reference via: docker scout cves --vex-location /etc/vex/ <image>
+COPY .vex/*.vex.json /etc/vex/
+
 WORKDIR /app
 
 # Add hosts entry in entrypoint script instead of here

docker/hyperdx/entry.local.base.sh

@@ -67,7 +67,7 @@ echo "ClickHouse is ready!"
 /otel-entrypoint.sh /usr/local/bin/opampsupervisor > /var/log/otel-collector.log 2>&1 &
 
 # Start HyperDX app
-concurrently \
+./node_modules/.bin/concurrently \
   "--kill-others-on-fail" \
   "--names=API,APP,ALERT-TASK" \
   "PORT=${HYPERDX_API_PORT:-8000} HYPERDX_APP_PORT=${HYPERDX_APP_PORT:-8080} node -r ./node_modules/@hyperdx/node-opentelemetry/build/src/tracing ./packages/api/build/index.js" \

docker/hyperdx/entry.prod.sh

@@ -13,7 +13,7 @@ echo "Visit the HyperDX UI at $FRONTEND_URL"
 echo ""
 
 # Use concurrently to run both the API and App servers
-concurrently \
+./node_modules/.bin/concurrently \
   "--kill-others-on-fail" \
   "--names=API,APP,ALERT-TASK" \
   "PORT=${HYPERDX_API_PORT:-8000} HYPERDX_APP_PORT=${HYPERDX_APP_PORT:-8080} node -r ./node_modules/@hyperdx/node-opentelemetry/build/src/tracing ./packages/api/build/index.js" \

package.json

@@ -75,6 +75,8 @@
     "cookie": "^0.7.0",
     "brace-expansion": "^2.0.2",
     "diff": "^5.2.2",
-    "on-headers": "^1.1.0"
+    "on-headers": "^1.1.0",
+    "fast-xml-parser": "^4.4.0",
+    "systeminformation": "^5.24.0"
   }
 }

packages/api/package.json

@@ -15,12 +15,13 @@
     "@opentelemetry/api": "^1.8.0",
     "@opentelemetry/host-metrics": "^0.35.5",
     "@opentelemetry/sdk-metrics": "^1.30.1",
-    "@slack/webhook": "^6.1.0",
+    "@slack/webhook": "^7.0.0",
     "@types/node": "^22.15.18",
     "ai": "5.0.59",
     "aws4": "^1.13.2",
     "chrono-node": "^2.9.0",
     "compression": "^1.7.4",
+    "concurrently": "^9.1.2",
     "connect-mongo": "^4.6.0",
     "cors": "^2.8.5",
     "cron": "^4.3.1",

packages/app/tests/e2e/components/ChartEditorComponent.ts

@@ -86,6 +86,7 @@ export class ChartEditorComponent {
     // need to wait for the recharts graph to render
     await this.page
       .locator('.recharts-responsive-container')
+      .first()
       .waitFor({ state: 'visible', timeout: 10000 });
   }