stacklok / toolhive-cloud-ui / 28456123212

79%

push

github

fix: remediate vulnerabilities (#519)

* fix: pin node:24.18.0-alpine to Alpine 3.24.1 to remediate OpenSSL CVEs

Pins both Dockerfiles to node:24.18.0-alpine at the digest that ships
libcrypto3/libssl3 3.5.7-r0, fixing 15 CVEs from the June 9 2026
OpenSSL advisory:
CVE-2026-34180..34183, CVE-2026-42764, CVE-2026-42766..42770,
CVE-2026-45445..45447, CVE-2026-7383, CVE-2026-9076

Ref: https://alpinelinux.org/posts/Alpine-3.24.1-released.html

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix: pin node:24.18.0-alpine to Alpine 3.24.1 to remediate OpenSSL CVEs

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix: upgrade deps to remediate npm audit vulnerabilities

Upgrades to fix 16 moderate/high CVEs:
- better-auth: 1.6.2 → ^1.6.11 (fixes GHSA-cq3f-vc6p-68fh)
- vite: ^8.0.5 → ^8.0.16 (fixes GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3)
- Transitive: undici → 7.28.0, hono → >=4.12.25, qs → >=6.15.2,
  shell-quote → >=1.8.4, js-yaml 3.x → 3.15.0, js-yaml 4.x → 4.3.0

Also migrates pnpm overrides from package.json to pnpm-workspace.yaml,
which is required by pnpm v10.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

241 of 319 branches covered (75.55%)

475 of 603 relevant lines covered (78.77%)

13.34 hits per line