fix(hub): harden release image dependencies

[crs48]

Summary

• install patched @hono/node-server@1.19.10 and hono@4.12.4 in the hub runtime image
• disable automatic optional peer installation so the Expo sqlite stack is not pulled into the server image
• remove npm and Corepack artifacts from the final runtime layer to drop vulnerable package-manager libraries from the scan

Validation

• reproduced the runtime-stage install in a clean temp workspace and confirmed the resulting pnpm store contained patched Hono packages and did not contain expo, tar, minimatch, glob, or diff
• attempted corepack pnpm --filter @xnetjs/hub test, but the current checkout fails earlier on unresolved internal workspace package entries and does not exercise this Docker-only change
• could not run a full docker build here because the Docker daemon is not running in this environment

Summary by CodeRabbit

• Chores
  • Optimized the Docker runtime image: selected runtime web-server dependencies and rebuilt the native database driver.
  • Disabled automatic peer dependency installation for more deterministic builds.
  • Aggressively removed build tools, package managers and caches while preserving application artifacts to reduce image size and surface fewer runtime files.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1a734861-8e62-4ba5-978f-85d275b06575

📥 Commits

Reviewing files that changed from the base of the PR and between 3660fbf and 49c57b8.

📒 Files selected for processing (1)

• packages/hub/Dockerfile

---

📝 Walkthrough

Walkthrough

The runtime stage of packages/hub/Dockerfile now replaces a generic pnpm install with targeted corepack pnpm add for specific Hono packages, disables peer auto-installation, rebuilds better-sqlite3 with the same filter, and adds aggressive cleanup of build deps, package manager binaries, and caches to slim the image. (50 words)

Changes

Cohort / File(s)	Summary
Hub Runtime Dockerfile packages/hub/Dockerfile	Replaced pnpm install with corepack pnpm add for @hono/node-server@1.19.10 and hono@4.12.4 scoped to @xnetjs/hub, disabled auto-install of peer deps, rebuilt better-sqlite3 with the same filter, retained hub artifact copy, and added removal of build deps, Corepack/PNPM/npm binaries, and caches.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 I nibbled installs, picked Hono with care,
Cleared crumbs of caches from corners of air,
Rebuilt tiny engines, packed only what's true,
A lighter hub runtime — hop, ship it anew! 🥕

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(hub): harden release image dependencies' directly and specifically addresses the main change—hardening hub release image dependencies by updating Hono packages and removing package-manager artifacts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch codex/hub-security-image-fix

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Greptile Summary

This PR hardens the hub Docker runtime image by pinning patched versions of @hono/node-server@1.19.10 and hono@4.12.4, disabling optional peer auto-installation, and stripping npm/corepack binaries and caches from the final layer to reduce the vulnerable-package surface area.

• The core security intent is sound: forcing newer, patched Hono releases and removing package-manager tooling from the scanned runtime image.
• The replacement of pnpm install --frozen-lockfile --prod --filter @xnetjs/hub... with pnpm add ... --filter @xnetjs/hub drops --frozen-lockfile and the workspace-recursive ... filter. This may leave workspace dependency packages (@xnetjs/core, @xnetjs/crypto, etc.) without their own production deps fully set up, and allows pnpm to re-resolve transitive deps outside the lockfile if peer conflicts arise.
• The pnpm global content store (typically /root/.local/share/pnpm/store) is not removed in the cleanup step, leaving duplicate package data in the final image layer and partially undermining the goal of a lean, clean runtime image.

Confidence Score: 3/5

• Mergeable with low-to-medium risk, but the install command change should be validated under a live Docker build before shipping to production.
• The security motivation is clear and the cleanup steps are correct. However, the behavioral difference between pnpm install --frozen-lockfile --prod --filter @xnetjs/hub... and pnpm add --filter @xnetjs/hub (no --frozen-lockfile, no ... recursion) has not been exercised with an actual docker build (per the PR description), leaving uncertainty about whether all workspace-package transitive deps are properly installed in the runtime image.
• packages/hub/Dockerfile — specifically the pnpm add invocation and the cleanup rm -rf lines.

Important Files Changed

Filename	Overview
packages/hub/Dockerfile	Replaces a full frozen-lockfile prod install with a targeted pnpm add of two patched Hono packages; drops --frozen-lockfile and the ... workspace-recursive filter, risking incomplete workspace-dep node_modules setup and non-reproducible resolution of other transitive deps. Also leaves the pnpm global content store in the image.

Sequence Diagram

sequenceDiagram
    participant B as Builder Stage
    participant R as Runtime Stage
    participant P as pnpm

    B->>B: apk add python3 make g++
    B->>B: corepack enable
    B->>P: pnpm install --frozen-lockfile --filter @xnetjs/hub...
    B->>B: pnpm build @xnetjs/hub

    R->>R: COPY package.json files + lockfile + patches
    R->>R: apk add .build-deps python3 make g++
    R->>R: corepack enable
    R->>P: pnpm add @hono/node-server@1.19.10 hono@4.12.4 --prod --filter @xnetjs/hub
    Note over R,P: No --frozen-lockfile and no ... recursive filter
    R->>P: pnpm exec npm rebuild better-sqlite3
    R->>R: apk del .build-deps
    R->>R: rm corepack/npm/pnpm binaries and module dirs
    Note over R: pnpm global store not removed from layer
    R->>R: COPY dist artifacts from Builder
    R->>R: CMD node packages/hub/dist/cli.js

Loading

_{Last reviewed commit: 49c57b8}

[greptile-apps]

pnpm add drops --frozen-lockfile and the workspace-recursive ... filter

The original command used pnpm install --frozen-lockfile --prod --filter @xnetjs/hub.... The new command drops two important guards:

1. No --frozen-lockfile — pnpm add is intentionally incompatible with --frozen-lockfile because it must update the lockfile for the two added packages. However, without this flag, pnpm is free to re-resolve any transitive dependency that has a version conflict with the newly pinned hono packages, potentially pulling in package versions that differ from what was tested.

2. --filter @xnetjs/hub (no ...) — The trailing ... in the original filter tells pnpm to also set up node_modules for every workspace package that hub depends on (@xnetjs/core, @xnetjs/crypto, @xnetjs/data, etc.). Without it, those workspace packages are linked as symlinks but their own transitive production dependencies may not be fully resolved through the workspace machinery, depending on the pnpm version. If any workspace package has prod deps that pnpm would otherwise hoist via the ... traversal, they will be absent at runtime.

A safer approach is to first do a full frozen install of all deps, then layer on only the two hono overrides as an explicit mutation step — or define pnpm overrides in the root package.json so you can still use pnpm install --frozen-lockfile --prod --filter @xnetjs/hub... with the pinned versions baked into the lockfile.

Suggested change

	&& corepack pnpm add @hono/node-server@1.19.10 hono@4.12.4 --prod --ignore-scripts --config.auto-install-peers=false --filter @xnetjs/hub \
	&& corepack pnpm install --frozen-lockfile --prod --ignore-scripts --filter @xnetjs/hub... \
	&& corepack pnpm add @hono/node-server@1.19.10 hono@4.12.4 --prod --ignore-scripts --config.auto-install-peers=false --filter @xnetjs/hub \

[greptile-apps]

pnpm global content store not cleaned up

The cleanup removes the corepack cache and the npm/corepack module directories, but the pnpm content-addressable global store (typically at /root/.local/share/pnpm/store in Alpine) is not removed. Because all installed packages are hard-linked from that store into node_modules, both copies end up in the same Docker layer and add unnecessary image weight. Adding the store path to the rm -rf call in this RUN layer (before the layer is committed) will drop that size without affecting the live node_modules.

Suggested change

	&& rm -rf /root/.cache/node/corepack /usr/local/lib/node_modules/corepack /usr/local/lib/node_modules/npm \
	&& rm -f /usr/local/bin/corepack /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/pnpm /usr/local/bin/pnpx
	&& rm -rf /root/.cache/node/corepack /root/.local/share/pnpm /usr/local/lib/node_modules/corepack /usr/local/lib/node_modules/npm \