Skip to content

fix(#21): upgrade frontend base image node:20-alpine → node:22-alpine #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
OmarEhab007 merged 2 commits into from
Apr 20, 2026
Merged

fix(#21): upgrade frontend base image node:20-alpine → node:22-alpine #24

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2a8ce46
fix(#21): upgrade frontend base image node:20-alpine → node:22-alpine
OmarEhab007 Apr 20, 2026
c4dc4d3
fix(#21): suppress picomatch CVE-2026-33671 in node:22-alpine npm bundle
OmarEhab007 Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 0 additions & 20 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,23 +18,3 @@ CVE-2023-43642
# internal/syscall/unix: Root.Chmod symlink follow — no upstream fix available yet.
CVE-2026-32282

# --- Frontend image: npm bundled packages (node:20-alpine) ---
# These CVEs are in npm's internal dependencies (usr/local/lib/node_modules/npm/),
# NOT in the application's own package.json. They are not reachable at runtime.
# Fix: upgrade base image to node:22-alpine or later — tracked as a separate ticket.

# cross-spawn: ReDoS via shell metachar in command (fixed in 7.0.5, 6.0.6)
CVE-2024-21538
# glob: command injection via malicious pattern (fixed in 10.5.0, 11.1.0)
CVE-2025-64756
# minimatch: ReDoS via crafted pattern (fixed in 9.0.6+, 10.2.1+)
CVE-2026-26996
CVE-2026-27903
CVE-2026-27904
# node-tar: arbitrary file write/read via path traversal (fixed in tar ≥ 7.5.x)
CVE-2026-23745
CVE-2026-23950
CVE-2026-24842
CVE-2026-26960
CVE-2026-29786
CVE-2026-31802
6 changes: 3 additions & 3 deletions frontend/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
#############################################
# Stage 1: Dependencies
#############################################
FROM node:20-alpine AS deps
FROM node:22-alpine AS deps

@coderabbitai coderabbitai Bot Apr 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Read-only check for frontend Node version drift across Dockerfile, package metadata, specs, and workflows.
# Expected result: Dockerfile, frontend CI setup-node version, and Node ambient types are intentionally aligned on Node 22,
# or any remaining Node 20 references are documented as intentional.

set -eu

echo "Dockerfile Node base images:"
rg -n 'FROM node:[0-9]+-alpine' frontend/Dockerfile

echo
echo "frontend/package.json Node type definitions:"
jq -r '.devDependencies["@types/node"] // empty' frontend/package.json

echo
echo "Spec references to setup-node / node versions:"
rg -n -C2 'setup-node|node 20|node-version|node-version-file' specs frontend package.json .github 2>/dev/null || true

echo
echo "Workflow setup-node blocks:"
fd -e yml -e yaml .github/workflows -x sh -c '
  echo "--- $1"
  sed -n "/setup-node/,+8p" "$1"
' sh {}

Repository: OmarEhab007/RemedyIQ

Length of output: 3849

Update CI workflows and TypeScript types to Node 22.

The Docker base image upgrade to node:22-alpine creates a mismatch with the CI toolchain. The workflows .github/workflows/ci.yml (lines 30-32) and .github/workflows/security.yml (lines 68-70, 143-145) still specify node-version: "20", and frontend/package.json declares @types/node: ^20. Update all three to Node 22:

  • Change node-version: "20" to "22" in both workflow files
  • Change @types/node: ^20 to ^22 in frontend/package.json
  • Update specs/013-eks-containerization/tasks.md and specs/013-eks-containerization/plan.md to reference Node 22

Without these changes, the frontend CI environment will diverge from the production Docker runtime.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@frontend/Dockerfile` at line 7, Update CI and type declarations to match the
new Docker base image node:22-alpine by changing all occurrences of
node-version: "20" to "22" in the GitHub workflows (.github/workflows/ci.yml and
.github/workflows/security.yml), bumping the frontend package type declaration
`@types/node` from ^20 to ^22 in frontend/package.json, and updating references to
Node 22 in specs/013-eks-containerization/tasks.md and
specs/013-eks-containerization/plan.md so the CI toolchain, TypeScript types,
and documentation align with the Docker runtime change.


# Install libc6-compat for compatibility with some npm packages
RUN apk add --no-cache libc6-compat
Expand All @@ -21,7 +21,7 @@ RUN npm ci --legacy-peer-deps
#############################################
# Stage 2: Builder
#############################################
FROM node:20-alpine AS builder
FROM node:22-alpine AS builder

WORKDIR /app

Expand Down Expand Up @@ -54,7 +54,7 @@ RUN npm run build
#############################################
# Stage 3: Runner
#############################################
FROM node:20-alpine AS runner
FROM node:22-alpine AS runner

WORKDIR /app

Expand Down
Loading