This commit is contained in:
pandeymangg
2026-03-09 16:26:44 +05:30
parent 96f173c3b1
commit 1c55cfb7f7

View File

@@ -74,6 +74,9 @@ RUN --mount=type=secret,id=database_url \
#
FROM base AS runner
# Upgrade Alpine system packages to pick up security patches (e.g. zlib CVE-2026-22184)
RUN apk update && apk upgrade --no-cache
# Update npm to latest, then create user
# Note: npm's bundled tar has a known vulnerability but npm is only used during build, not at runtime
RUN npm install --ignore-scripts -g npm@latest \