Matches the pattern already applied in Dockerfile.custom_ui and the
apk del in the wolfi-based Dockerfiles. Without this, scanners can
still report the old npm-bundled tar/minimatch versions from dpkg
metadata.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Addresses 3 recent npm & Python CVEs:
- CVE-2026-27903/27904 (minimatch regex DoS)
- GHSA-qffp-2rhf-9h96 (tar path traversal)
- CVE-2026-27888 (pypdf regex DoS)
Changes:
- Bump tar from 7.5.8 to 7.5.10 in all 5 Dockerfiles + package.json overrides
- Bump minimatch from 10.2.1 to 10.2.4 in all Dockerfiles + package.json overrides
- Bump pypdf from 6.6.2 to 6.7.3 in requirements.txt
- Remove apk npm after global install to eliminate stale SBOM metadata
Docker Scout verification: both litellm and litellm-non_root now report 0 CVEs.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Prisma CLI recently started bootstrapping npm@10 inside the runtime image, which now fails with a sizeCalculation cache error on the slim Python base. Installing Debian's nodejs/npm (along with libatomic1) lets Prisma reuse the system binaries so prisma generate completes again.
