Repository navigation
fix: SECURITY FIX! Add Trivy vulnerability scanner and mitigate security issues - #10949
codearranger wants to merge 2 commits into
Conversation
Add GitHub Actions workflow for Trivy vulnerability scanning and fix all identified security vulnerabilities: - CVE-2025-66414 (HIGH): Upgrade @modelcontextprotocol/sdk to ^1.24.0 - CVE-2024-21538 (HIGH): Fix cross-spawn via node:22-alpine base image - CVE-2025-64756 (HIGH): Mitigate glob CLI injection via base image upgrade - CVE-2025-13466 (MEDIUM): Add body-parser override to ^2.2.1 - CVE-2025-5889 (LOW): Fix brace-expansion via node:22-alpine base image 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
@danny-avila Can you please approve the workflows? |
codearranger
changed the title
| } | ||
| } | ||
| }, | ||
| "body-parser": "^2.2.1" |
There was a problem hiding this comment.
not necessary, already addressed
| # Install jemalloc | ||
| RUN apk add --no-cache jemalloc | ||
| # Upgrade npm to fix CVE-2025-64756 (glob command injection) | ||
| RUN npm install -g npm@latest |
There was a problem hiding this comment.
not an acceptable command, as this could silently change how packages work
| RUN apk add --no-cache python3 py3-pip uv | ||
|
|
||
| # Upgrade npm to fix CVE-2025-64756 (glob command injection) | ||
| RUN npm install -g npm@latest |
There was a problem hiding this comment.
not an acceptable command, as this could silently change how packages work
|
|
||
| # Base node image | ||
| FROM node:20-alpine AS node | ||
| FROM node:22-alpine AS node |
There was a problem hiding this comment.
node v22 has issues with some of our dependencies, we would need to test in a separate PR
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
These items are already addressed.
node v22 would not be compatible with our OpenID SDK dependency, likely would need to test node v24 as the solution here.
I would appreciate this as its own workflow, and separate any docker image edits as well to their own workflow, as well as the reasoning for using Trivy as opposed to another automated security scan tool. |
3 participants
Summary
This PR adds a Trivy vulnerability scanner GitHub Actions workflow and mitigates all security vulnerabilities identified by it.
Security Fixes
Changes
.github/workflows/trivy.yml)@modelcontextprotocol/sdkfrom ^1.21.0 to ^1.24.0 inapi/package.jsonandpackages/api/package.jsonbody-parseroverride to ^2.2.1 in rootpackage.jsonnode:20-alpinetonode:22-alpineinDockerfileandDockerfile.multinpm install -g npm@latestto Dockerfiles to fix glob CLI vulnerabilityChange Type
Testing
npm audit- shows 0 vulnerabilitiesnpm run test:api- backend tests passTest Configuration
Checklist