Remove unused package managers from the production Docker image after installing Yarnl's dependencies. This removes the 15 vulnerability findings in npm's bundled dependencies identified in v0.11.5.
The candidate image passed a full Trivy scan with zero known vulnerabilities in Alpine system packages and detected JavaScript packages. Runtime smoke tests passed for password hashing, image processing, Brotli downloads, JSON/form parsing, file uploads, and response compression.
Updating
No migration or configuration changes are needed. Pull the updated image and recreate the container:
docker compose pull yarnl
docker compose up -d yarnlYarnl starts directly with Node.js. npm, npx, Yarn, and Corepack are no longer available inside the production container. Normal app features and Docker updates are unchanged. Non-Docker installations are unaffected by this packaging change.
Images: titandrive/yarnl:0.11.6 and titandrive/yarnl:latest for linux/amd64 and linux/arm64.
Full Changelog: v0.11.5...v0.11.6