From a91e737e69591c5ae53708cb5f208e9a52f40a1b Mon Sep 17 00:00:00 2001 From: Charles Bochet Date: Mon, 8 Jun 2026 18:03:21 +0200 Subject: [PATCH] fix(docker): bump Node 24.16.0 (OpenSSL fix), strip unused cruft, dedupe node-forge (#21322) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hardens the `prod-twenty` server image. Built `--target twenty-server` and walked it to verify each change. - **Node 24.15.0 → 24.16.0** (all stages + `.nvmrc`): 24.15.0 links OpenSSL **3.5.5** (CVE-2026-31798), 24.16.0 links **3.5.6** — the proper fix (deleting headers only hid it; the binary still linked the vuln lib). - **Remove the bundled npm CLI** (`ip-address`): app uses yarn via corepack, never npm; npm still bundles `ip-address@10.1.0` and its latest 10.2.0 is itself unfixed — no upgrade path. - **Remove vendored `example/` apps** (`passport-microsoft/example` ships a `package-lock.json` for an old Express demo, never installed/run; not in our lockfile). - **node-forge → 1.4.0** (Critical CVE-2026-33606) via `yarn dedupe` — lockfile-only, no phantom dep, no root resolution. Verified on the built image: node 24.16.0 / openssl 3.5.6, npm CLI + example dirs absent, node-forge@1.4.0 only. **Not included (need CI/QA):** real deps pinned inside `@nestjs/*`/`express` (`lodash@4.17.21`, `file-type`, `path-to-regexp`, `ws`, `qs`) need parent bumps or scoped resolutions; standalone `undici@5.29.0` (5→7), `apollo-server-core@3` (EOL), `typeorm`, etc. (`axios` already patched.) --- .nvmrc | 2 +- packages/twenty-docker/twenty/Dockerfile | 19 +++++++++++++++---- yarn.lock | 9 +-------- 3 files changed, 17 insertions(+), 13 deletions(-) diff --git a/.nvmrc b/.nvmrc index 341cb50613..b832e4001d 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -24.5.0 +24.16.0 diff --git a/packages/twenty-docker/twenty/Dockerfile b/packages/twenty-docker/twenty/Dockerfile index bbf79056b6..49537b7271 100644 --- a/packages/twenty-docker/twenty/Dockerfile +++ b/packages/twenty-docker/twenty/Dockerfile @@ -2,7 +2,7 @@ # Dependency stages # =========================================================================== -FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS front-deps +FROM node:24.16.0-alpine3.23@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14 AS front-deps WORKDIR /app @@ -20,7 +20,7 @@ COPY ./packages/twenty-client-sdk/package.json /app/packages/twenty-client-sdk/ RUN yarn workspaces focus twenty twenty-front twenty-front-component-renderer twenty-ui twenty-shared twenty-sdk twenty-client-sdk && yarn cache clean && npx nx reset -FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS server-deps +FROM node:24.16.0-alpine3.23@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14 AS server-deps WORKDIR /app @@ -84,7 +84,7 @@ RUN if [ -d /app/packages/twenty-front/build ]; then \ # docker build --target twenty-server -f packages/twenty-docker/twenty/Dockerfile . # =========================================================================== -FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS twenty-server +FROM node:24.16.0-alpine3.23@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14 AS twenty-server RUN apk add --no-cache \ 'curl>=8.19.0-r0' \ @@ -121,6 +121,17 @@ COPY --chown=1000 --from=twenty-server-build /app/packages/twenty-client-sdk/dis LABEL org.opencontainers.image.source=https://github.com/twentyhq/twenty LABEL org.opencontainers.image.description="Twenty server image (no frontend)." +# Remove unused, unpatchable components the scanner flags (none are executed at +# runtime, and none can be fixed by upgrading our deps or Node): +# - the bundled npm CLI: the app uses yarn via corepack and never invokes npm, +# and npm's bundled ip-address has no patched release; +# - example/ apps vendored inside dependencies, e.g. passport-microsoft's +# example/login ships a package-lock.json for an old Express demo +# (body-parser, ejs, express, ...) that is never installed or run. +# (The OpenSSL CVE is fixed properly by the Node base bump above, not by deletion.) +RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx && \ + find /app/node_modules -type d -name example -prune -exec rm -rf {} + + RUN mkdir -p /app/.local-storage /app/packages/twenty-server/.local-storage && \ chown 1000:1000 /app/.local-storage /app/packages/twenty-server/.local-storage @@ -191,7 +202,7 @@ RUN S6_ARCH=$(cat /tmp/s6arch) && \ echo "$NOARCH_SUM s6-overlay-noarch.tar.xz" | sha256sum -c - && \ echo "$ARCH_SUM s6-overlay-arch.tar.xz" | sha256sum -c - -FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS twenty-app-dev +FROM node:24.16.0-alpine3.23@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14 AS twenty-app-dev # s6-overlay COPY --from=s6-fetch /tmp/s6-overlay-noarch.tar.xz /tmp/ diff --git a/yarn.lock b/yarn.lock index 4afd303977..bb12f1b833 100644 --- a/yarn.lock +++ b/yarn.lock @@ -46136,20 +46136,13 @@ __metadata: languageName: node linkType: hard -"node-forge@npm:^1": +"node-forge@npm:^1, node-forge@npm:^1.3.1": version: 1.4.0 resolution: "node-forge@npm:1.4.0" checksum: 10c0/67330a5f1f95257a4c8a93b7d555abe87b5f15e350123aa396c97a21a8ca94f9c6549008eb2c73668a91e0d7e3a905785acbd8f8bd0751c29401292011f8f8e1 languageName: node linkType: hard -"node-forge@npm:^1.3.1": - version: 1.3.2 - resolution: "node-forge@npm:1.3.2" - checksum: 10c0/1def35652c93a588718a6d0d0b4f33e3e7de283aa6f4c00d01d1605d6ccce23fb3b59bcbfb6434014acd23a251cfcc2736052b406f53d94e1b19c09d289d0176 - languageName: node - linkType: hard - "node-gyp-build-optional-packages@npm:5.2.2": version: 5.2.2 resolution: "node-gyp-build-optional-packages@npm:5.2.2"