Patch Changes
-
9f0adcf: Ship only production dependencies in the container image and bump axios
The production stage inherited
node_modulesfrom the builder, which rannpm ciand therefore installed devDependencies too — 261 installed packages instead of the 95 the compiled entrypoint needs.npm prune --omit=devdrops them before the copy. axios was separately held at 1.9.0 by the lockfile although the declared range already allowed the fixed releases.Together these take the image from 81 advisories with a fix available (2 critical) down to 20 (0 critical).