oriolrius/pki-manager-web v3.9.2

v3.9.2 — Resolve all 141 container-scan CVE alerts

on GitHub

🔒 Security — container-image CVE cleanup

Resolves all 141 open Trivy code-scanning alerts (backend 127 → 0, frontend 14 → 0). Every alert came from the Trivy scan of the published container images — there were no source/CodeQL findings. Both images were rebuilt and re-scanned locally with Trivy (0 vulnerabilities); this tag build re-scans them in CI.

Container images (docker/Dockerfile)

• apk upgrade in both final stages patches base-image OS CVEs (libexpat, c-ares).
• The runtime backend stage is pure node, so it no longer installs corepack/pnpm and removes the bundled npm/npx — dropping the shipped pnpm cache (tar, minimatch, glob, ip-address, brace-expansion) and npm's sigstore/tar CVEs. Build pnpm bumped to 10.34.5.

Dependencies

• Bumped vulnerable backend prod deps: @fastify/swagger 9.8, @fastify/swagger-ui 6.1 (pulls patched @fastify/static/glob/minimatch), @trpc/server 11.8, drizzle-orm 0.45.2, fastify 5.10, js-yaml 4.2, node-forge 1.4.
• pnpm.overrides pin patched transitives shipped in the backend image (axios, dompurify, qs, ajv, fast-uri, yaml, uuid, lodash, seroval, immutable, form-data, follow-redirects, brace-expansion, shell-quote, minimatch).
• Frontend @trpc/* client bumped to 11.8 to match the server.

Code

• external.routes.ts: typed the setErrorHandler error param as FastifyError (fastify 5.10 now infers it as unknown).

Verification

backend typecheck/build + 620 tests · frontend typecheck + 45 tests + build · pnpm install --frozen-lockfile · local Trivy scan of both freshly built images (0 vulnerabilities).

Merged via #6. Full changelog: v3.9.1...v3.9.2