From a56541ba2668e370962b2fc3638b5a5f615b5983 Mon Sep 17 00:00:00 2001 From: Harshit28j Date: Sun, 8 Mar 2026 02:28:13 +0530 Subject: [PATCH] fix(docker): purge apt-tracked npm in Dockerfile.dev to remove stale SBOM metadata Matches the pattern already applied in Dockerfile.custom_ui and the apk del in the wolfi-based Dockerfiles. Without this, scanners can still report the old npm-bundled tar/minimatch versions from dpkg metadata. Co-Authored-By: Claude Opus 4.6 --- docker/Dockerfile.dev | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docker/Dockerfile.dev b/docker/Dockerfile.dev index 95099954c97..df408bdccdf 100644 --- a/docker/Dockerfile.dev +++ b/docker/Dockerfile.dev @@ -94,7 +94,8 @@ RUN apt-get update && apt-get upgrade -y \ done \ && find / -path "*/node_modules/npm/package.json" -exec \ sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null \ - && npm cache clean --force + && npm cache clean --force \ + && apt-get purge -y npm && apt-get autoremove -y WORKDIR /app