From 51673f8cdbec11e4b1b2b92731b5625d8794baff Mon Sep 17 00:00:00 2001 From: Harshit Jain Date: Fri, 16 Jan 2026 21:44:25 +0530 Subject: [PATCH] non-root glob patch test --- Dockerfile | 4 ++++ docker/Dockerfile.custom_ui | 4 ++++ docker/Dockerfile.database | 4 ++++ docker/Dockerfile.dev | 4 ++++ docker/Dockerfile.non_root | 10 ++++++++++ 5 files changed, 26 insertions(+) diff --git a/Dockerfile b/Dockerfile index 0e7a8412bbc..72f93fa0682 100644 --- a/Dockerfile +++ b/Dockerfile @@ -49,6 +49,10 @@ USER root # Install runtime dependencies RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip +# Fix CVE-2025-64756: Update glob packages to patched versions (>=10.5.0 or >=11.1.0) +# This patches the HIGH severity Command Injection vulnerability in glob CLI +RUN npm update -g glob || true + WORKDIR /app # Copy the current directory contents into the container at /app COPY . . diff --git a/docker/Dockerfile.custom_ui b/docker/Dockerfile.custom_ui index c437929a27e..88a21be38be 100644 --- a/docker/Dockerfile.custom_ui +++ b/docker/Dockerfile.custom_ui @@ -7,6 +7,10 @@ WORKDIR /app # Install Node.js and npm (adjust version as needed) RUN apt-get update && apt-get install -y nodejs npm +# Fix CVE-2025-64756: Update glob packages to patched versions (>=10.5.0 or >=11.1.0) +# This patches the HIGH severity Command Injection vulnerability in glob CLI +RUN npm update -g glob || true + # Copy the UI source into the container COPY ./ui/litellm-dashboard /app/ui/litellm-dashboard diff --git a/docker/Dockerfile.database b/docker/Dockerfile.database index 49655129506..e7dcace9401 100644 --- a/docker/Dockerfile.database +++ b/docker/Dockerfile.database @@ -51,6 +51,10 @@ USER root # Install runtime dependencies RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile +# Fix CVE-2025-64756: Update glob packages to patched versions (>=10.5.0 or >=11.1.0) +# This patches the HIGH severity Command Injection vulnerability in glob CLI +RUN npm update -g glob || true + WORKDIR /app # Copy the current directory contents into the container at /app COPY . . diff --git a/docker/Dockerfile.dev b/docker/Dockerfile.dev index 67966f9c739..737947836ff 100644 --- a/docker/Dockerfile.dev +++ b/docker/Dockerfile.dev @@ -63,6 +63,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ npm \ && rm -rf /var/lib/apt/lists/* +# Fix CVE-2025-64756: Update glob packages to patched versions (>=10.5.0 or >=11.1.0) +# This patches the HIGH severity Command Injection vulnerability in glob CLI +RUN npm update -g glob || true + WORKDIR /app # Copy only necessary runtime files diff --git a/docker/Dockerfile.non_root b/docker/Dockerfile.non_root index 363b17c68fd..2cb187807ab 100644 --- a/docker/Dockerfile.non_root +++ b/docker/Dockerfile.non_root @@ -89,6 +89,14 @@ RUN prisma generate && \ prisma --version && \ prisma migrate diff --from-empty --to-schema-datamodel ./schema.prisma --script > /dev/null 2>&1 || true +RUN NPM_DIR=$(find /usr/lib/python3.13/site-packages -type d -path "*/node_modules/npm" 2>/dev/null | head -n 1) && \ + if [ -n "$NPM_DIR" ]; then \ + echo "Found npm at: $NPM_DIR"; \ + cd "$NPM_DIR" && npm update glob --depth 9999 || true; \ + else \ + echo "WARNING: Could not find nodejs_wheel npm directory"; \ + fi + # ----------------- # Runtime Stage # ----------------- @@ -105,6 +113,8 @@ RUN for i in 1 2 3; do \ apk add --no-cache python3 py3-pip bash openssl tzdata nodejs npm supervisor && break || sleep 5; \ done +RUN npm update -g glob || true + # Copy artifacts from builder COPY --from=builder /app/requirements.txt /app/requirements.txt COPY --from=builder /app/docker/entrypoint.sh /app/docker/prod_entrypoint.sh /app/docker/