Skip to content

fix(security): resolve CRITICAL and HIGH Dependabot vulnerabilities #1729

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ajile-in merged 11 commits into from
Sep 7, 2026
Merged

fix(security): resolve CRITICAL and HIGH Dependabot vulnerabilities #1729

Show file tree
Hide file tree
Changes from 10 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
01da638
fix(deps): remove unused direct dependencies (handlebars, protobufjs,…
ajile-in Aug 26, 2026
67299df
fix(deps): bump axios to ^1.20.0, fix 8 Dependabot alerts
ajile-in Aug 26, 2026
c0d6781
fix(deps): update opentelemetry and socket.io-client for transitive v…
ajile-in Aug 26, 2026
87aec98
fix(deps): add pnpm.overrides for transitive vulnerability fixes
ajile-in Aug 26, 2026
247cc35
fix(security): override transitive deps for CRITICAL/HIGH vulns
ajile-in Aug 26, 2026
47844eb
fix(security): override transitive deps for remaining MEDIUM/LOW vulns
ajile-in Aug 26, 2026
dd05381
fix(security): P0+P1 — rebuild base images, bump pnpm
ajile-in Aug 26, 2026
5521b0f
fix(security): correct sha512 hash for pnpm 9.15.9 packageManager field
ajile-in Aug 26, 2026
8dcf9c6
test(api-gateway): add tracer, dependency-integrity and bundle smoke …
ajile-in Sep 6, 2026
0780100
fix(test): address CodeRabbit review on test specs
ajile-in Sep 6, 2026
7a6d946
fix(docker): run agent-provisioning image as non-root user
ajile-in Sep 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,5 +33,8 @@ jobs:
- name: Generate Prisma client
run: pnpm exec prisma generate --schema=libs/prisma-service/prisma/schema.prisma

- name: Build api-gateway bundle for smoke tests
run: pnpm exec nest build api-gateway

- name: Run tests
run: pnpm jest --config jest.ci.config.js --runInBand
15 changes: 7 additions & 8 deletions Dockerfiles/Dockerfile.agent-provisioning
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
# Install OpenSSL
RUN apk update && apk upgrade
RUN apk add --no-cache openssl
Expand All @@ -10,21 +10,20 @@
docker \
docker-compose \
jq \
&& npm install -g pnpm --ignore-scripts \
&& npm install -g pnpm@9.15.9 --ignore-scripts \
&& export PATH=$PATH:/usr/lib/node_modules/pnpm/bin \
&& rm -rf /var/cache/apk/*

# Set the working directory
WORKDIR /app

# Copy package.json and package-lock.json
COPY package.json ./
COPY pnpm-workspace.yaml ./
# Copy package.json, pnpm-lock.yaml and pnpm-workspace.yaml
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./

ENV PUPPETEER_SKIP_DOWNLOAD=true

# Install dependencies while ignoring scripts (including Puppeteer's installation)
RUN pnpm i --ignore-scripts
RUN pnpm i --frozen-lockfile --ignore-scripts

# Copy the rest of the application code
COPY . .
Expand All @@ -38,7 +37,7 @@
RUN pnpm run build agent-provisioning

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24

Check warning on line 40 in Dockerfiles/Dockerfile.agent-provisioning

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

The "node" image runs with "root" as the default user. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=credebl_platform&issues=AaB4SXz4MwQY_bvuOF-B&open=AaB4SXz4MwQY_bvuOF-B&pullRequest=1729
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
# Install OpenSSL
RUN apk update && apk upgrade
RUN apk add --no-cache openssl
Expand All @@ -49,7 +48,7 @@
docker \
docker-compose \
jq \
&& npm install -g pnpm --ignore-scripts \
&& npm install -g pnpm@9.15.9 --ignore-scripts \
&& export PATH=$PATH:/usr/lib/node_modules/pnpm/bin \
&& rm -rf /var/cache/apk/*

Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.agent-service
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache \
openssl \
openssh-client \
aws-cli \
docker \
docker-compose \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -18,7 +18,7 @@ RUN pnpm run build agent-service
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache \
openssl \
openssh-client \
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.api-gateway
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -13,7 +13,7 @@ RUN pnpm run build api-gateway
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.cloud-wallet
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -13,7 +13,7 @@ RUN pnpm run build cloud-wallet
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.connection
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -13,7 +13,7 @@ RUN pnpm run build connection
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.ecosystem
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -13,7 +13,7 @@ RUN pnpm run build ecosystem
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.geolocation
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -13,7 +13,7 @@ RUN pnpm run build geo-location
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.issuance
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -13,7 +13,7 @@ RUN pnpm run build issuance
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.ledger
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -13,7 +13,7 @@ RUN pnpm run build ledger
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.notification
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl && rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -12,7 +12,7 @@ RUN pnpm run build notification
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.oid4vc-issuance
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl && rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -12,7 +12,7 @@ RUN pnpm run build oid4vc-issuance
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.oid4vc-verification
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -13,7 +13,7 @@ RUN pnpm run build oid4vc-verification
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.organization
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -13,7 +13,7 @@ RUN pnpm run build organization
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
4 changes: 2 additions & 2 deletions Dockerfiles/Dockerfile.seed
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache \
postgresql-client \
openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
&& adduser -S nextjs -u 1001 \
&& npm install -g pnpm@9.15.3 --ignore-scripts
&& npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY . .
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.user
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -13,7 +13,7 @@ RUN pnpm run build user
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.utility
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -13,7 +13,7 @@ RUN pnpm run build utility
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.verification
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -13,7 +13,7 @@ RUN pnpm run build verification
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
6 changes: 3 additions & 3 deletions Dockerfiles/Dockerfile.webhook
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Stage 1: Build the application
FROM node:24-alpine3.23 AS build
FROM node:24-alpine3.24 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
RUN npm install -g pnpm@9.15.9 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true
Expand All @@ -13,7 +13,7 @@ RUN pnpm run build webhook
RUN pnpm prune --prod

# Stage 2: Create the final image
FROM node:24-alpine3.23
FROM node:24-alpine3.24
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
Expand Down
Loading