Skip to content

Updated vulnerable packages #1573

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KambleSahil3 merged 14 commits into from
Mar 23, 2026
Merged

Updated vulnerable packages #1573

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
857ad18
Updated vulnerable packages and Updated all Dockerfiles to use Node.j…
DeepakNemad Feb 25, 2026
aaed3a4
Fix: Resolve Dockerfile vulnerabilities and cleanup
DeepakNemad Feb 25, 2026
284d545
Fix: Resolve the Coderabit changes
DeepakNemad Feb 25, 2026
9a636f7
Fix: Resolve Dockerfile vulnerabilities and cleanup
DeepakNemad Feb 25, 2026
4e06601
Fix: Resolve the sonarqube changes
DeepakNemad Feb 25, 2026
2c92b13
Fix: Resolve the sonarqube changes
DeepakNemad Feb 25, 2026
24ad3df
Fix: Resolve the sonarqube changes
DeepakNemad Feb 25, 2026
d23d50f
Fix: Resolve the sonarqube changes
DeepakNemad Feb 25, 2026
fe80364
Fixed coderabit suggested changes
DeepakNemad Mar 12, 2026
b99fa33
Fixed coderabit suggested changes
DeepakNemad Mar 12, 2026
ea4df07
All 19 Dockerfiles have been updated consistently while maintaining t…
DeepakNemad Mar 16, 2026
8092250
fixed agent proviosining issue
DeepakNemad Mar 20, 2026
bab86b9
Added stable version of openssl
DeepakNemad Mar 23, 2026
b0835f8
Added stable version of openssl
DeepakNemad Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
106 changes: 36 additions & 70 deletions Dockerfiles/Dockerfile.agent-provisioning
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,83 +1,49 @@
# Stage 1: Build the application
FROM node:18-alpine as build
# Install OpenSSL
RUN apk update && apk upgrade
RUN apk add --no-cache openssl
RUN set -eux \
&& apk --no-cache add \
openssh-client \
aws-cli \
docker \
docker-compose \
jq \
&& npm install -g pnpm --ignore-scripts \
&& export PATH=$PATH:/usr/lib/node_modules/pnpm/bin \
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache \
openssl \
openssh-client \
aws-cli \
docker \
docker-compose \
jq \
&& rm -rf /var/cache/apk/*

# Set the working directory
RUN npm install -g pnpm@latest --ignore-scripts
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
WORKDIR /app

# Copy package.json and package-lock.json
COPY package.json ./
COPY pnpm-workspace.yaml ./

COPY package.json pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true

# Install dependencies while ignoring scripts (including Puppeteer's installation)
RUN pnpm i --ignore-scripts
Comment thread
coderabbitai[bot] marked this conversation as resolved.

# Copy the rest of the application code
COPY . .

# Generate Prisma client
# RUN cd libs/prisma-service && npx prisma migrate deploy && npx prisma generate
RUN cd libs/prisma-service && npx prisma generate
RUN ls -R /app/apps/agent-provisioning/AFJ/
Comment thread
coderabbitai[bot] marked this conversation as resolved.

# Build the user service
RUN pnpm run build agent-provisioning

# Stage 2: Create the final image
FROM node:18-alpine as prod
# Install OpenSSL
RUN apk update && apk upgrade
RUN apk add --no-cache openssl
RUN set -eux \
&& apk --no-cache add \
openssh-client \
aws-cli \
docker \
docker-compose \
jq \
&& npm install -g pnpm --ignore-scripts \
&& export PATH=$PATH:/usr/lib/node_modules/pnpm/bin \
&& rm -rf /var/cache/apk/*

FROM node:24-alpine3.21
RUN apk update && apk upgrade && apk add --no-cache \
openssl \
openssh-client \
aws-cli \
docker \
docker-compose \
jq \
&& rm -rf /var/cache/apk/* \

@coderabbitai coderabbitai Bot Feb 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

find apps/agent-provisioning -type f \( -name "*.ts" -o -name "*.js" -o -name "*.sh" \) | head -20

Repository: credebl/platform

Length of output: 655

🏁 Script executed:

rg -n '\b(docker|aws)\b' apps/agent-provisioning/ --type=ts -C2

Repository: credebl/platform

Length of output: 42

🏁 Script executed:

rg -n 'docker|docker-compose|aws' apps/agent-provisioning/AFJ/ -C2

Repository: credebl/platform

Length of output: 13892

🏁 Script executed:

rg -n '\bexec(Sync)?\(' apps/agent-provisioning/ --type=ts -A2 | grep -E '(docker|aws)'

Repository: credebl/platform

Length of output: 42

🏁 Script executed:

rg -n 'spawn|exec|shell' apps/agent-provisioning/src/ --type=ts -B2 -A2

Repository: credebl/platform

Length of output: 2358

🏁 Script executed:

rg -n "import.*child_process" apps/agent-provisioning/src/ --type=ts

Repository: credebl/platform

Length of output: 157

🏁 Script executed:

cat apps/agent-provisioning/src/agent-provisioning.service.ts | head -100

Repository: credebl/platform

Length of output: 4118

Confirm runtime dependency of aws-cli, docker, and docker-compose packages.

The agent-provisioning service invokes these tools at runtime via shell scripts (start_agent_ecs.sh, start_agent.sh) executed during wallet provisioning requests. The walletProvision method in agent-provisioning.service.ts calls exec() to spin up agent containers and register ECS task definitions. These packages are justified runtime dependencies, though they significantly increase final image size and CVE surface. Consider evaluating whether to use lightweight alternatives or if image size/security posture is acceptable for this service's operational model.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@Dockerfiles/Dockerfile.agent-provisioning` around lines 22 - 29, The
Dockerfile currently installs heavy runtime packages (aws-cli, docker,
docker-compose) that are used by shell scripts (start_agent_ecs.sh,
start_agent.sh) and by the walletProvision method in
agent-provisioning.service.ts via exec(); confirm whether these commands truly
must run inside the container at runtime and if not remove them from the final
image or replace with lighter alternatives (use AWS SDK calls from
walletProvision instead of aws-cli, call remote Docker daemon or include only
the docker client binary, or move tooling to a sidecar/host or a build-stage so
final image size/CVE surface is reduced); update the Dockerfile and the
referenced scripts/service accordingly and document the chosen operational model
if you keep the packages.

&& addgroup -g 1001 -S nodejs \
&& adduser -S nextjs -u 1001
WORKDIR /app

RUN mkdir -p ./agent-provisioning/AFJ/endpoints
RUN mkdir -p ./agent-provisioning/AFJ/agent-config
RUN mkdir -p ./agent-provisioning/AFJ/port-file
RUN mkdir -p ./agent-provisioning/AFJ/token


# Copy the compiled code
COPY --from=build /app/dist/apps/agent-provisioning/ ./dist/apps/agent-provisioning/
COPY --from=build /app/node_modules ./node_modules
COPY --from=build /app/apps/agent-provisioning/AFJ/scripts ./agent-provisioning/AFJ/scripts
COPY --from=build /app/apps/agent-provisioning/AFJ/port-file ./agent-provisioning/AFJ/port-file

# Set permissions
RUN chmod +x /app/agent-provisioning/AFJ/scripts/start_agent.sh
RUN chmod +x /app/agent-provisioning/AFJ/scripts/start_agent_ecs.sh
RUN chmod +x /app/agent-provisioning/AFJ/scripts/docker_start_agent.sh
RUN chmod +x /app/agent-provisioning/AFJ/scripts/fargate.sh
RUN chmod 777 /app/agent-provisioning/AFJ/endpoints
RUN chmod 777 /app/agent-provisioning/AFJ/agent-config
RUN chmod 777 /app/agent-provisioning/AFJ/token

# Copy the libs folder
COPY libs/ ./libs/

# Set the command to run the microservice
RUN mkdir -p ./agent-provisioning/AFJ/endpoints \
&& mkdir -p ./agent-provisioning/AFJ/agent-config \
&& mkdir -p ./agent-provisioning/AFJ/port-file \
&& mkdir -p ./agent-provisioning/AFJ/token
COPY --from=build --chown=nextjs:nodejs /app/dist/apps/agent-provisioning/ ./dist/apps/agent-provisioning/
COPY --from=build --chown=nextjs:nodejs /app/node_modules ./node_modules
COPY --from=build --chown=nextjs:nodejs /app/apps/agent-provisioning/AFJ/scripts ./agent-provisioning/AFJ/scripts
COPY --from=build --chown=nextjs:nodejs /app/apps/agent-provisioning/AFJ/port-file ./agent-provisioning/AFJ/port-file
COPY --from=build --chown=nextjs:nodejs /app/libs/ ./libs/
RUN chmod +x /app/agent-provisioning/AFJ/scripts/*.sh \
&& chmod 755 /app/agent-provisioning/AFJ/endpoints \
&& chmod 755 /app/agent-provisioning/AFJ/agent-config \
&& chmod 755 /app/agent-provisioning/AFJ/token \
&& chown -R nextjs:nodejs /app/agent-provisioning
USER nextjs
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && npx prisma generate && cd ../.. && node dist/apps/agent-provisioning/main.js"]
Comment thread
coderabbitai[bot] marked this conversation as resolved.
70 changes: 24 additions & 46 deletions Dockerfiles/Dockerfile.agent-service
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,57 +1,35 @@
# Stage 1: Build the application
FROM node:18-alpine as build
# Install OpenSSL
RUN apk add --no-cache openssl
RUN npm install -g pnpm --ignore-scripts \
&& apk update \
&& apk add openssh-client \
&& apk add aws-cli \
&& apk add docker \
&& apk add docker-compose

RUN npm install -g pnpm
# Set the working directory
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache \
openssl \
openssh-client \
aws-cli \
docker \
docker-compose \
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@latest --ignore-scripts
WORKDIR /app

# Copy package.json and package-lock.json
COPY package.json ./
COPY pnpm-workspace.yaml ./

COPY package.json pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true

# Install dependencies while ignoring scripts (including Puppeteer's installation)
RUN pnpm i --ignore-scripts
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated

# Copy the rest of the application code
COPY . .
# RUN cd libs/prisma-service && npx prisma migrate deploy && npx prisma generate
RUN cd libs/prisma-service && npx prisma generate

# Build the user service
RUN pnpm run build agent-service

# Stage 2: Create the final image
FROM node:18-alpine
# Install OpenSSL
RUN apk add --no-cache openssl
RUN npm install -g pnpm --ignore-scripts \
&& apk update \
&& apk add openssh-client \
&& apk add aws-cli \
&& apk add docker \
&& apk add docker-compose

# RUN npm install -g pnpm
# Set the working directory
FROM node:24-alpine3.21
RUN apk update && apk upgrade && apk add --no-cache \
openssl \
openssh-client \
aws-cli \
docker \
docker-compose \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
&& adduser -S nextjs -u 1001
WORKDIR /app

# Copy the compiled code from the build stage
COPY --from=build /app/dist/apps/agent-service/ ./dist/apps/agent-service/

# Copy the libs folder from the build stage
COPY --from=build /app/libs/ ./libs/
#COPY --from=build /app/package.json ./
COPY --from=build /app/node_modules ./node_modules

# Set the command to run the microservice
COPY --from=build --chown=nextjs:nodejs /app/dist/apps/agent-service/ ./dist/apps/agent-service/
COPY --from=build --chown=nextjs:nodejs /app/libs/ ./libs/
COPY --from=build --chown=nextjs:nodejs /app/node_modules ./node_modules
USER nextjs
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && npx prisma generate && cd ../.. && node dist/apps/agent-service/main.js"]
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
46 changes: 13 additions & 33 deletions Dockerfiles/Dockerfile.api-gateway
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,44 +1,24 @@
# Stage 1: Build the application
FROM node:18-alpine as build
# Install OpenSSL
RUN apk add --no-cache openssl
RUN npm install -g pnpm
# Set the working directory
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl && rm -rf /var/cache/apk/*
RUN npm install -g pnpm@latest
WORKDIR /app

# Copy package.json and package-lock.json
COPY package.json ./
COPY pnpm-workspace.yaml ./
# COPY package-lock.json ./

COPY package.json pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true

# Install dependencies while ignoring scripts (including Puppeteer's installation)
RUN pnpm i --ignore-scripts
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated

# Copy the rest of the application code
COPY . .
# RUN cd libs/prisma-service && npx prisma migrate deploy && npx prisma generate
RUN cd libs/prisma-service && npx prisma generate

# Build the api-gateway service
RUN pnpm run build api-gateway

# Stage 2: Create the final image
FROM node:18-alpine
# Install OpenSSL
RUN apk add --no-cache openssl

# Set the working directory
FROM node:24-alpine3.21
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
&& adduser -S nextjs -u 1001
WORKDIR /app

# Copy the compiled code from the build stage
COPY --from=build /app/dist/apps/api-gateway/ ./dist/apps/api-gateway/

# Copy the libs folder from the build stage
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
# COPY --from=build /app/uploadedFiles ./uploadedFiles

# Set the command to run the microservice
COPY --from=build --chown=nextjs:nodejs /app/dist/apps/api-gateway/ ./dist/apps/api-gateway/
COPY --from=build --chown=nextjs:nodejs /app/libs/ ./libs/
COPY --from=build --chown=nextjs:nodejs /app/node_modules ./node_modules
USER nextjs
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && npx prisma generate && cd ../.. && node dist/apps/api-gateway/main.js"]
48 changes: 13 additions & 35 deletions Dockerfiles/Dockerfile.cloud-wallet
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,46 +1,24 @@
# Stage 1: Build the application
FROM node:18-alpine AS build
# Install OpenSSL
RUN apk add --no-cache openssl
RUN npm install -g pnpm

# Set the working directory
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl && rm -rf /var/cache/apk/*
RUN npm install -g pnpm@latest
WORKDIR /app

# Copy package.json and package-lock.json
COPY package.json ./
COPY pnpm-workspace.yaml ./

COPY package.json pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true

# Install dependencies while ignoring scripts (including Puppeteer's installation)
RUN pnpm i --ignore-scripts
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated

# Copy the rest of the application code
COPY . .
# RUN cd libs/prisma-service && npx prisma migrate deploy && npx prisma generate
RUN cd libs/prisma-service && npx prisma generate

# Build the user service
RUN pnpm run build cloud-wallet

# Stage 2: Create the final image
FROM node:18-alpine

RUN apk add --no-cache openssl

# Set the working directory
FROM node:24-alpine3.21
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
&& adduser -S nextjs -u 1001
WORKDIR /app
# RUN npm install -g pnpm

# Copy the compiled code from the build stage
COPY --from=build /app/dist/apps/cloud-wallet/ ./dist/apps/cloud-wallet/

# Copy the libs folder from the build stage
COPY --from=build /app/libs/ ./libs/
#COPY --from=build /app/package.json ./
COPY --from=build /app/node_modules ./node_modules


# Set the command to run the microservice
COPY --from=build --chown=nextjs:nodejs /app/dist/apps/cloud-wallet/ ./dist/apps/cloud-wallet/
COPY --from=build --chown=nextjs:nodejs /app/libs/ ./libs/
COPY --from=build --chown=nextjs:nodejs /app/node_modules ./node_modules
USER nextjs
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && npx prisma generate && cd ../.. && node dist/apps/cloud-wallet/main.js"]
49 changes: 13 additions & 36 deletions Dockerfiles/Dockerfile.connection
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,47 +1,24 @@
# Stage 1: Build the application
FROM node:18-alpine as build
# Install OpenSSL
RUN apk add --no-cache openssl
RUN npm install -g pnpm
# Set the working directory
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl && rm -rf /var/cache/apk/*
RUN npm install -g pnpm@latest
WORKDIR /app

# Copy package.json and package-lock.json
COPY package.json ./
COPY pnpm-workspace.yaml ./
#COPY package-lock.json ./

COPY package.json pnpm-workspace.yaml ./
ENV PUPPETEER_SKIP_DOWNLOAD=true

# Install dependencies while ignoring scripts (including Puppeteer's installation)
RUN pnpm i --ignore-scripts
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated

# Copy the rest of the application code
COPY . .
# RUN cd libs/prisma-service && npx prisma migrate deploy && npx prisma generate
RUN cd libs/prisma-service && npx prisma generate

# Build the connection service
RUN pnpm run build connection

# Stage 2: Create the final image
FROM node:18-alpine
# Install OpenSSL
RUN apk add --no-cache openssl
# RUN npm install -g pnpm
# Set the working directory
FROM node:24-alpine3.21
RUN apk update && apk upgrade && apk add --no-cache openssl \
&& rm -rf /var/cache/apk/* \
&& addgroup -g 1001 -S nodejs \
&& adduser -S nextjs -u 1001
WORKDIR /app

# Copy the compiled code from the build stage
COPY --from=build /app/dist/apps/connection/ ./dist/apps/connection/

# Copy the libs folder from the build stage
COPY --from=build /app/libs/ ./libs/
#COPY --from=build /app/package.json ./
COPY --from=build /app/node_modules ./node_modules

# Install production dependencies for the final image
#RUN npm i --only=production

# Set the command to run the microservice
COPY --from=build --chown=nextjs:nodejs /app/dist/apps/connection/ ./dist/apps/connection/
COPY --from=build --chown=nextjs:nodejs /app/libs/ ./libs/
COPY --from=build --chown=nextjs:nodejs /app/node_modules ./node_modules
USER nextjs
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && npx prisma generate && cd ../.. && node dist/apps/connection/main.js"]

@coderabbitai coderabbitai Bot Feb 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, let's locate and examine the Dockerfile
find . -name "Dockerfile.connection" -o -name "Dockerfile" | head -20

Repository: credebl/platform

Length of output: 95

🏁 Script executed:

# Once we find the file, let's examine it
cat -n Dockerfiles/Dockerfile.connection 2>/dev/null || cat -n Dockerfile.connection 2>/dev/null

Repository: credebl/platform

Length of output: 1230

🏁 Script executed:

# Search for migration-related patterns in Docker/compose files
find . -type f \( -name "Dockerfile*" -o -name "docker-compose*" -o -name "*.dockerfile" \) | head -20

Repository: credebl/platform

Length of output: 772

🏁 Script executed:

# Check other Dockerfiles for similar migration patterns
grep -r "prisma migrate" Dockerfiles/ 2>/dev/null | head -20

Repository: credebl/platform

Length of output: 3429

🏁 Script executed:

# Examine docker-compose-dev.yml for migration strategy
cat -n docker-compose-dev.yml 2>/dev/null | head -100

Repository: credebl/platform

Length of output: 3201

🏁 Script executed:

# Search for any init container or migration job configuration
find . -type f \( -name "*.yml" -o -name "*.yaml" -o -name "*.json" \) -path "*k8s*" -o -path "*kubernetes*" 2>/dev/null | head -10

Repository: credebl/platform

Length of output: 42

Refactor to use a separate migration job before app startup.

Line 24 executes prisma migrate deploy during container startup, creating rollout risk. Migrations running in CMD cause:

  • App startup failure if migrations fail
  • Race conditions when multiple instances start simultaneously
  • Complex recovery scenarios on deployment failures

Implement a separate, one-shot migration job (init container or pre-deployment hook) that completes before app instances start. Note: This pattern affects all application Dockerfiles (agent-provisioning, agent-service, api-gateway, cloud-wallet, connection, ecosystem, geolocation, issuance, ledger, notification, oid4vc-issuance, oid4vc-verification, organization, user, utility, verification, webhook, x509).

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@Dockerfiles/Dockerfile.connection` at line 24, The Dockerfile currently runs
migrations in the container CMD (the line invoking "npx prisma migrate deploy &&
npx prisma generate" inside CMD), which should be removed from the app startup
path; instead create a separate one‑shot migration job (init container or
pre-deploy hook) that runs the commands "npx prisma migrate deploy && npx prisma
generate" against the same built image or a dedicated migration image, and
change the Dockerfile CMD to only start the app (e.g., run "node
dist/apps/connection/main.js"); apply this same change to all Dockerfiles that
contain the migration invocation (agent-provisioning, agent-service,
api-gateway, cloud-wallet, connection, ecosystem, geolocation, issuance, ledger,
notification, oid4vc-issuance, oid4vc-verification, organization, user, utility,
verification, webhook, x509) so migrations run once before app replicas start.

Loading