From 49c57b863b0e1964182e366e1944779eaea60907 Mon Sep 17 00:00:00 2001 From: crs48 Date: Mon, 9 Mar 2026 10:46:20 -0700 Subject: [PATCH] fix(hub): harden release image dependencies - install the hub runtime dependencies with patched Hono releases in the image build - disable automatic optional peer installation so the Expo sqlite stack is not pulled into the server image - remove npm and corepack artifacts from the final runtime layer to eliminate vulnerable package-manager libraries --- packages/hub/Dockerfile | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/packages/hub/Dockerfile b/packages/hub/Dockerfile index 1d33cb3a5..ec4a125df 100644 --- a/packages/hub/Dockerfile +++ b/packages/hub/Dockerfile @@ -60,9 +60,12 @@ COPY --from=builder /build/patches/ patches/ RUN apk add --no-cache --virtual .build-deps python3 make g++ \ && corepack enable \ - && pnpm install --frozen-lockfile --prod --ignore-scripts --filter @xnetjs/hub... \ - && pnpm --filter @xnetjs/hub exec npm rebuild better-sqlite3 \ - && apk del .build-deps + # Keep the runtime image on patched Hono releases without auto-installing optional peer stacks like expo-sqlite. + && corepack pnpm add @hono/node-server@1.19.10 hono@4.12.4 --prod --ignore-scripts --config.auto-install-peers=false --filter @xnetjs/hub \ + && corepack pnpm --filter @xnetjs/hub exec npm rebuild better-sqlite3 \ + && apk del .build-deps \ + && rm -rf /root/.cache/node/corepack /usr/local/lib/node_modules/corepack /usr/local/lib/node_modules/npm \ + && rm -f /usr/local/bin/corepack /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/pnpm /usr/local/bin/pnpx # Copy built artifacts COPY --from=builder /build/packages/hub/dist packages/hub/dist/