Fix the npm vulnerability

hemilabs · Mar 4, 2025 · 04ec910 · 04ec910
1 parent dacb5cb
commit 04ec910
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/.github/workflows/docker-checks.yml b/.github/workflows/docker-checks.yml
@@ -27,7 +27,6 @@ jobs:
           ignore-unfixed: true
           image-ref: ${{ github.repository }}:${{ github.sha }}
           list-all-pkgs: true
-          scan-ref: ${{ github.workspace}}/${{ matrix.context }}
           severity: HIGH,CRITICAL
     strategy:
       matrix:

diff --git a/staking-points/Dockerfile b/staking-points/Dockerfile
@@ -2,6 +2,9 @@ FROM node:20.18.3-alpine
 
 ENV NODE_ENV=production
 
+# Fix the cross-spawn vulnerability in the preinstalled npm version
+RUN npm i --global [email protected]
+
 WORKDIR /app
 
 COPY package*.json .