From c600eff94f4ba8fb017fcaa5e41bc2cedb030c5d Mon Sep 17 00:00:00 2001 From: Piyush Singh Date: Fri, 23 Oct 2026 11:05:47 +0530 Subject: [PATCH 1/4] chore(deps): bump node to 24 in dockerfile node 16 is end-of-life and has no security patches. move the build stage to node:24-alpine. --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 09f1886..f102037 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # build environment -FROM node:16-alpine AS build +FROM node:24-alpine AS build WORKDIR /app COPY package*.json ./ RUN npm install --omit=dev From 4bf333c14814c7a06ef03d1a11cc2b45b49977d3 Mon Sep 17 00:00:00 2001 From: Piyush Singh Date: Fri, 23 Oct 2026 11:53:46 +0530 Subject: [PATCH 2/4] fix(sonar): lock dependency install in dockerfile use npm ci with the lockfile and skip lifecycle scripts for the production install so resolved versions are pinned. --- Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index f102037..8cb465d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,8 @@ FROM node:24-alpine AS build WORKDIR /app COPY package*.json ./ -RUN npm install --omit=dev +RUN npm i --package-lock-only --ignore-scripts +RUN npm ci --omit=dev --ignore-scripts COPY . . RUN npm run build From d5907ad248226e9d2d5818b5ec0938334ccf36a7 Mon Sep 17 00:00:00 2001 From: Piyush Singh Date: Fri, 23 Oct 2026 11:57:28 +0530 Subject: [PATCH 3/4] fix(sonar): drop redundant lockfile regeneration in dockerfile npm ci already requires and uses the committed lockfile, so the separate package-lock-only step is not needed. --- Dockerfile | 1 - 1 file changed, 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 8cb465d..ee1c1a0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,6 @@ FROM node:24-alpine AS build WORKDIR /app COPY package*.json ./ -RUN npm i --package-lock-only --ignore-scripts RUN npm ci --omit=dev --ignore-scripts COPY . . RUN npm run build From 508765a7a334f0d8d96fbff6b2ea094a28b6e703 Mon Sep 17 00:00:00 2001 From: Piyush Singh Date: Mon, 26 Oct 2026 15:57:54 +0530 Subject: [PATCH 4/4] chore(deps): pin exact node 24.22.1 in dockerfile pin the build image to the exact fixed release instead of the floating 24-alpine tag. --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index ee1c1a0..c16d3fe 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # build environment -FROM node:24-alpine AS build +FROM node:24.22.1-alpine AS build WORKDIR /app COPY package*.json ./ RUN npm ci --omit=dev --ignore-scripts