fix: upgrade shelljs to 0.9.0 and tmp to 0.2.3 to fix vulnerabilities#282
Open
xufulin1994 wants to merge 3 commits intomasterfrom
Open
fix: upgrade shelljs to 0.9.0 and tmp to 0.2.3 to fix vulnerabilities#282xufulin1994 wants to merge 3 commits intomasterfrom
xufulin1994 wants to merge 3 commits intomasterfrom
Conversation
- Upgrade shelljs from ^0.8.5 to ^0.9.0 - Upgrade tmp from ^0.1.0 to ^0.2.3 - Update Node.js requirement from >=12.1.0 to >=18.0.0 - Update .nvmrc from v12.1.0 to v18 - Update Dockerfile base image from mhart/alpine-node:16 to node:18-alpine
xufulin1994
added
the
change/standard
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review infoConfiguration used: Organization UI Review profile: CHILL Plan: Pro Disabled knowledge base sources:
📒 Files selected for processing (1)
WalkthroughUpdated Node runtime target to Node 18 across config and container; Dockerfile now uses Changes
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
Dockerfile (1)
1-10:⚠️ Potential issue | 🟠 MajorContainer runs as root — add a non-root
USERdirective.No
USERinstruction is present, so the process inside the container runs asroot. This is a security risk confirmed by Trivy (DS-0002): if the container is ever compromised, the attacker has full root access to the container's filesystem.🔒 Proposed fix
RUN yarn install --frozen-lockfile --non-interactive + +RUN addgroup -S appgroup && adduser -S appuser -G appgroup +USER appuser ENTRYPOINT ["./reslang"]🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile` around lines 1 - 10, The container currently runs as root because there is no USER directive; create a non-root user and group (e.g., appuser) and set ownership of the WORKDIR and application files before switching to that user, then add USER appuser (or the chosen name) so ENTRYPOINT ["./reslang"] runs unprivileged; update Dockerfile around WORKDIR /app/reslang, COPY, and RUN yarn install to chown the files and switch to the new user after installation and file ownership are set.package.json (1)
16-16:⚠️ Potential issue | 🟠 MajorUpdate
@types/tmpand@types/shelljsto match upgraded runtime packages — TypeScript compilation will fail otherwise.
@types/tmpat^0.1.0is incompatible withtmpupgraded to^0.2.3. Version 0.2.2+ introduced API changes with incompatible type shapes. Update to^0.2.6.@types/shelljsat^0.8.5is incompatible withshelljsat^0.9.0. Update to^0.10.0.Proposed fix
- "@types/shelljs": "^0.8.5", + "@types/shelljs": "^0.10.0",- "@types/tmp": "^0.1.0", + "@types/tmp": "^0.2.6",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` at line 16, The devDependency type packages are out of sync with upgraded runtime packages causing TypeScript compile errors; update package.json so `@types/tmp` is bumped to ^0.2.6 (to match tmp ^0.2.3) and `@types/shelljs` is bumped to ^0.10.0 (to match shelljs ^0.9.0), then reinstall (npm/yarn) and commit the updated lockfile so TS compilation uses the correct type shapes for tmp and shelljs.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@Dockerfile`:
- Around line 1-10: The container currently runs as root because there is no
USER directive; create a non-root user and group (e.g., appuser) and set
ownership of the WORKDIR and application files before switching to that user,
then add USER appuser (or the chosen name) so ENTRYPOINT ["./reslang"] runs
unprivileged; update Dockerfile around WORKDIR /app/reslang, COPY, and RUN yarn
install to chown the files and switch to the new user after installation and
file ownership are set.
In `@package.json`:
- Line 16: The devDependency type packages are out of sync with upgraded runtime
packages causing TypeScript compile errors; update package.json so `@types/tmp` is
bumped to ^0.2.6 (to match tmp ^0.2.3) and `@types/shelljs` is bumped to ^0.10.0
(to match shelljs ^0.9.0), then reinstall (npm/yarn) and commit the updated
lockfile so TS compilation uses the correct type shapes for tmp and shelljs.
ℹ️ Review info
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (3)
.nvmrcDockerfilepackage.json
- Add non-root user (appuser) to Dockerfile for security (DS-0002) - Update @types/shelljs from ^0.8.5 to ^0.10.0 (match shelljs ^0.9.0) - Update @types/tmp from ^0.1.0 to ^0.2.6 (match tmp ^0.2.3)
Combine RUN commands using && to reduce image layers per Sonar recommendation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit