Skip to content

Fix CVEs#31

Merged
jonkiky merged 6 commits into1.3.0from
CBIO-429
Mar 6, 2026
Merged

Fix CVEs#31
jonkiky merged 6 commits into1.3.0from
CBIO-429

Conversation

@johnyesit
Copy link
Contributor

This pull request updates the project's Node.js and Next.js dependencies to their latest major versions and applies important security patches to the Docker build process. The changes focus on modernizing the runtime environment and ensuring the application is protected against recent vulnerabilities.

Dependency and Environment Upgrades:

  • Upgraded the base Docker image from node:22-alpine3.22 to node:24-alpine3.22, ensuring compatibility with the latest Node.js features and security updates.
  • Updated next and eslint-config-next in package.json to version 16.1.5, providing access to new features and bug fixes in the Next.js ecosystem. [1] [2]

Security Improvements:

  • Added a step in the Docker build to refresh the package index and upgrade both openssl and libssl3, addressing CVE-2025-15467 and CVE-2025-4575 across all build stages.
  • Removed redundant apk upgrade commands in the deps stage, since the base image now handles the OpenSSL upgrade for all stages.

@johnyesit johnyesit requested a review from jonkiky March 5, 2026 19:20
@jonkiky jonkiky merged commit 249b2c9 into 1.3.0 Mar 6, 2026
2 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants