Listenarrs/Listenarr 0.2.68

Canary 0.2.68

on GitHub

This PR attempts to clean up a bunch of security scanner findings that have been accumulating; some were straightforward package bumps, others required digging into why the Docker image was producing false-looking hits.

Fixed

• CVE-2026-4800 (High) — Code injection via _.template imports key names: bumped lodash from 4.17.23 to 4.18.1 in /fe and /listenarr.api/tools/discord-bot lockfiles.
• CVE-2026-2950 (Medium) — Prototype pollution via array path bypass in _.unset / _.omit: resolved by the same lodash 4.18.1 bump.
• CVE-2023-29403 / CVE-2022-30635 (High) — golang/stdlib 1.19.8 in the Debian-packaged gosu binary: both Dockerfiles now build gosu from source in a golang:1.24-alpine multi-stage stage, replacing the apt package entirely.
• CVE-2026-23950 / CVE-2026-29786 / CVE-2026-31802 / CVE-2026-24842 / CVE-2026-23745 (High) — vulnerable tar versions bundled inside the apt-shipped npm tree (/usr/lib/node_modules/npm/node_modules): both Dockerfiles now upgrade npm to latest immediately after installing Node.js and remove the stale apt npm tree.
• CVE-2026-26996 (High) — minimatch 9.0.5 in the apt-shipped npm bundled packages: resolved by the same npm upgrade and cleanup.
• CVE-2024-21538 (High) — cross-spawn 7.0.3 in the apt-shipped npm bundled packages: resolved by the same npm upgrade and cleanup.

Changed

• Dockerfile and Dockerfile.runtime: added a golang:1.24-alpine builder stage to compile a static gosu binary; gosu removed from apt-get install.
• Dockerfile and Dockerfile.runtime: after installing Node.js via NodeSource, run npm install -g npm@latest then remove /usr/lib/node_modules/npm, /usr/bin/npm, and /usr/bin/npx so the only npm in the image is the patched version in /usr/local.
• fe/package-lock.json: lodash node_modules/lodash entry updated from 4.17.23 to 4.18.1.
• listenarr.api/tools/discord-bot/package-lock.json: lodash `node_modules/lodash...

Automated canary build

• Version: 0.2.68
• Commit: 68fbe15
• Original PR: #475