From f08b1b63fa713c8ada3a499515cfa8b0e6b81444 Mon Sep 17 00:00:00 2001 From: user <70670632+stuxf@users.noreply.github.com> Date: Thu, 7 May 2026 23:56:43 +0000 Subject: [PATCH] Bump npm 11.12.1 -> 11.14.0 to clear ip-address GHSA-v2v4-37r5-5v8g Empirical grype scan of the built runtime image flagged ip-address@10.1.0 (Medium) bundled inside /usr/local/lib/node_modules/npm. npm@11.14.0 bundles ip-address@10.1.1 which carries the fix. Verified by rebuilding the image and rescanning: ip-address finding gone. Co-Authored-By: Claude Opus 4.7 (1M context) --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 75e6143a32..091527eeb1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -69,7 +69,7 @@ FROM $LITELLM_RUNTIME_IMAGE AS runtime USER root RUN apk add --no-cache bash openssl tzdata nodejs npm python3 libsndfile supervisor && \ - npm install -g npm@11.12.1 tar@7.5.11 glob@13.0.6 @isaacs/brace-expansion@5.0.1 brace-expansion@5.0.5 minimatch@10.2.4 diff@8.0.3 picomatch@4.0.4 && \ + npm install -g npm@11.14.0 tar@7.5.11 glob@13.0.6 @isaacs/brace-expansion@5.0.1 brace-expansion@5.0.5 minimatch@10.2.4 diff@8.0.3 picomatch@4.0.4 && \ GLOBAL="$(npm root -g)" && \ for pkg in tar glob @isaacs/brace-expansion brace-expansion minimatch diff picomatch; do \ name="${pkg##*/}"; \