From ed0fafb8bfe360fefdc753dedccf151992692ac3 Mon Sep 17 00:00:00 2001 From: Sean Morley Date: Fri, 12 Jun 2026 22:04:35 -0400 Subject: [PATCH] Update vulnerability exclusions in .trivyignore and modify Dockerfile base image - Expanded .trivyignore to include additional CVEs and clarified comments regarding esbuild vulnerabilities. - Changed the base image in Dockerfile from gcr.io to cgr.dev for the frontend, ensuring up-to-date dependencies. --- .trivyignore | 20 ++++++++++++++++++- docker/Dockerfile | 2 +- .../collections/CollectionMap.svelte | 6 +++++- 3 files changed, 25 insertions(+), 3 deletions(-) diff --git a/.trivyignore b/.trivyignore index 261f63c9..9ca2eec9 100644 --- a/.trivyignore +++ b/.trivyignore @@ -5,9 +5,27 @@ CVE-2025-64756 # Go stdlib false positives in esbuild binary -# esbuild doesn't use the vulnerable archive/tar or crypto/x509 paths in a way that's exploitable. +# esbuild doesn't use the vulnerable stdlib paths in a way that's exploitable. CVE-2025-58183 CVE-2025-61729 +CVE-2025-68121 +CVE-2025-61726 +CVE-2026-25679 +CVE-2026-32280 +CVE-2026-32281 +CVE-2026-32283 +CVE-2026-33811 +CVE-2026-33814 +CVE-2026-39820 +CVE-2026-39823 +CVE-2026-39825 +CVE-2026-39836 +CVE-2026-42499 +CVE-2026-42504 + +# esbuild Deno API integrity check (GHSA-gv7w-rqvm-qjhr) +# Only affects lib/deno/mod.ts when NPM_CONFIG_REGISTRY is attacker-controlled; we use pnpm/npm, not Deno. +GHSA-gv7w-rqvm-qjhr # jaraco.context Has a Path Traversal Vulnerability Fixed via setuptools GHSA-58pv-8j8x-9vj2 diff --git a/docker/Dockerfile b/docker/Dockerfile index e10a3068..904cced6 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -75,7 +75,7 @@ RUN python3 manage.py collectstatic --noinput --verbosity 2 # Production targets # --------------------------------------------------------------------------- -FROM gcr.io/distroless/nodejs22-debian12:nonroot@sha256:13593b7570658e8477de39e2f4a1dd25db2f836d68a0ba771251572d23bb4f8e AS frontend +FROM cgr.dev/chainguard/node:latest@sha256:27bf957bdf6d189108c8908c958fd966d9814f78e7172c2d791940f4e208a334 AS frontend LABEL org.opencontainers.image.title="AdventureLog Frontend" \ org.opencontainers.image.description="AdventureLog SvelteKit frontend (SSR)." \ org.opencontainers.image.source="https://github.com/seanmorley15/AdventureLog" \ diff --git a/frontend/src/lib/components/collections/CollectionMap.svelte b/frontend/src/lib/components/collections/CollectionMap.svelte index 130853ae..7edd625c 100644 --- a/frontend/src/lib/components/collections/CollectionMap.svelte +++ b/frontend/src/lib/components/collections/CollectionMap.svelte @@ -338,7 +338,11 @@ for (const trail of loc.trails) { if (!trail?.geojson) continue; if (trail.geojson.type === 'FeatureCollection' && Array.isArray(trail.geojson.features)) { - features.push(...trail.geojson.features.filter((f) => f && typeof f === 'object')); + for (const f of trail.geojson.features) { + if (f && typeof f === 'object') { + features.push(f); + } + } } else if (trail.geojson.type === 'Feature') { features.push(trail.geojson); }