fix(docker): clear image CVEs (OpenSSL, bundled ffmpeg, undici/ws/brace-expansion) #293

Merged

sionzee merged 1 commit from claude/image-cves into main

2026-10-22 16:43:54 +02:00

sionzee commented

2026-10-22 16:39:56 +02:00

Owner

Clears the image scan findings (16 critical / 400 high).

Bundled ffmpeg 7.0.2: removed ffmpeg-static. prism-media (used by @discordjs/voice) tried it before the system binary, so the bundled one was what actually ran. Voice now uses Alpine's apk ffmpeg (8.1.2 on the current oven/bun:1-alpine, Alpine 3.24.3). Checked inside the built image: FFmpeg.getInfo() resolves to ffmpeg 8.1.2.
OpenSSL / base packages: apk upgrade at build, plus pull: true in the Docker workflow, so a stale cached base can't come back.
npm: discord.js dev → undici 8.12.3, ws 8.22.0, brace-expansion 5.0.12, @orpc/* 1.16.1 (medium CORS Vary-header CVE).
bun install --production in the image: tsgo/tsgolint ship Go binaries with stdlib CVEs, and faker is test-only. None of them are used at runtime.

Verification

Trivy on the built image: 0 vulnerabilities at any severity.
tsgo / oxlint / bun run test are identical to main: 571 pre-existing tsgo errors, 5 lint warnings, 1 failing test and 1 error, all already on main.
Nothing for the host to do on deploy.

🤖 Generated with Claude Code

Clears the image scan findings (16 critical / 400 high). - **Bundled ffmpeg 7.0.2**: removed `ffmpeg-static`. prism-media (used by `@discordjs/voice`) tried it before the system binary, so the bundled one was what actually ran. Voice now uses Alpine's apk ffmpeg (8.1.2 on the current `oven/bun:1-alpine`, Alpine 3.24.3). Checked inside the built image: `FFmpeg.getInfo()` resolves to `ffmpeg 8.1.2`. - **OpenSSL / base packages**: `apk upgrade` at build, plus `pull: true` in the Docker workflow, so a stale cached base can't come back. - **npm**: discord.js dev → undici 8.12.3, ws 8.22.0, brace-expansion 5.0.12, `@orpc/*` 1.16.1 (medium CORS Vary-header CVE). - **`bun install --production`** in the image: tsgo/tsgolint ship Go binaries with stdlib CVEs, and faker is test-only. None of them are used at runtime. **Verification** - Trivy on the built image: **0 vulnerabilities at any severity**. - tsgo / oxlint / `bun run test` are identical to `main`: 571 pre-existing tsgo errors, 5 lint warnings, 1 failing test and 1 error, all already on `main`. - Nothing for the host to do on deploy. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

sionzee added 1 commit

2026-10-22 16:39:57 +02:00

fix(docker): clear image CVEs (OpenSSL, bundled ffmpeg, undici/ws/brace-expansion)

OpenCodeReview / review (deepseek) (pull_request) Failing after 7s

Details

CI / test (pull_request) Failing after 50s

Details

OpenCodeReview / review (luna) (pull_request) Successful in 1m21s

Details

55ea65d106

- Drop ffmpeg-static: prism-media preferred its bundled ffmpeg 7.0.2 over the
  system one. Voice now uses Alpine's ffmpeg (8.1.2 on the current base).
- apk upgrade at build and pull: true in CI so base packages (OpenSSL) are
  never served from a stale cached base.
- Install with --production: tsgo/tsgolint ship Go binaries with stdlib CVEs
  and faker is test-only; none are needed at runtime.
- discord.js dev -> undici 8.12.3; ws 8.22.0; brace-expansion 5.0.12;
  @orpc/* 1.16.1 (CORS Vary header CVE).

Trivy on the built image: 0 vulnerabilities at any severity.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

ocr-bot reviewed

2026-10-22 16:41:18 +02:00

ocr-bot left a comment

OpenCodeReview

Review complete: 0 finding(s) across 3 selected item(s).

_{model openai/gpt-5.6-luna · 3 file(s) reviewed · 186,307 tokens (178,705 in / 7,602 out / 142,336 cached — 80% of input) · 1m17s}

### OpenCodeReview Review complete: 0 finding(s) across 3 selected item(s). --- <sub>model `openai/gpt-5.6-luna` · 3 file(s) reviewed · 186,307 tokens (178,705 in / 7,602 out / 142,336 cached — 80% of input) · 1m17s</sub>