vulncheck
dde12cbfe4
Dockhand scans the TrueVuln images with Trivy and Grype. Both reported critical findings that already had fixes, all in packages the images control: - PyJWT 2.13.0 -> 2.15.1, and pip is uninstalled after the requirements; its vendored urllib3, msgpack and pkg_resources were the rest of the backend's fixable findings and nothing runs pip at runtime. - Next.js 16.3.1 -> 16.4.3, sharp 0.35.5, source-map-js 1.2.2. The frontend builds on node:24-trixie-slim: bookworm keeps zlib and glibc CVEs Debian will not fix there. The runner drops npm, npx and corepack (server.js needs only node) and takes the Debian security updates. - nginx takes the Alpine updates for curl and brotli. Rescanned images built from this tree: no critical and no fixable finding left in backend, frontend or nginx, in either engine. What remains are Debian packages without a fix yet, Grype's Python 3.11 binary matches (fixes listed only for 3.13+), and gosu inside the upstream postgres:15-alpine image.
36 lines
813 B
JSON
36 lines
813 B
JSON
{
|
|
"name": "frontend",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"scripts": {
|
|
"dev": "next dev",
|
|
"build": "next build --webpack",
|
|
"start": "next start",
|
|
"lint": "eslint"
|
|
},
|
|
"dependencies": {
|
|
"@headlessui/react": "^2.2.9",
|
|
"@heroicons/react": "^2.2.0",
|
|
"@tailwindcss/typography": "^0.5.19",
|
|
"axios": "^1.19.0",
|
|
"clsx": "^2.1.1",
|
|
"daisyui": "^5.5.14",
|
|
"date-fns": "^4.1.0",
|
|
"next": "^16.4.3",
|
|
"qrcode.react": "^4.2.0",
|
|
"react": "19.2.3",
|
|
"react-dom": "19.2.3",
|
|
"tailwind-merge": "^3.4.0"
|
|
},
|
|
"devDependencies": {
|
|
"@tailwindcss/postcss": "^4",
|
|
"@types/node": "^20",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"eslint": "^9",
|
|
"eslint-config-next": "^16.4.3",
|
|
"tailwindcss": "^4",
|
|
"typescript": "^5"
|
|
}
|
|
}
|