Hartmut/CapaKraken
1
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix: script portability and npm security updates

Browse Source 
Scripts:
- stop.sh: replace Linux-only fuser with cross-platform lsof fallback
- start.sh: parameterize port (APP_PORT) and container name (dynamic lookup)
- app-dev-start.sh: cross-platform stat (GNU -c / BSD -f) and setpriv/su fallback
- deploy-compose.sh: parameterize Docker registry via DOCKER_REGISTRY env var
- harden-postgres.sh: make DB_USER and DB_NAME configurable via env vars

NPM security:
- next: 15.5.12 → 15.5.15 (fixes HTTP request smuggling CVE)
- nodemailer: 8.0.1 → 8.0.5 (fixes SMTP command injection CVEs)
- lodash-es: add pnpm override to force >=4.18.0 (fixes code injection + prototype pollution)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Hartmut Nörenberg
2026-04-10 14:06:58 +02:00
parent e4bf121b33
commit 78d50b78d3
9 changed files with 102 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tooling/deploy/deploy-compose.sh
+2 -1
View File
@@ -32,8 +32,9 @@ echo "App env file: ${APP_ENV_FILE}"
echo "App image: ${APP_IMAGE}"
echo "Migrator image: ${MIGRATOR_IMAGE}"
DOCKER_REGISTRY="${DOCKER_REGISTRY:-ghcr.io}"
if [ -n "${GHCR_USERNAME:-}" ] && [ -n "${GHCR_TOKEN:-}" ]; then
printf '%s\n' "${GHCR_TOKEN}" | docker login ghcr.io -u "${GHCR_USERNAME}" --password-stdin
printf '%s\n' "${GHCR_TOKEN}" | docker login "${DOCKER_REGISTRY}" -u "${GHCR_USERNAME}" --password-stdin
fi
docker compose -f "${COMPOSE_FILE}" config -q
tooling/docker/app-dev-start.sh
+18 -5
View File
@@ -17,15 +17,28 @@ pnpm --filter @capakraken/db db:migrate:deploy
pnpm check:exports
pnpm check:imports
repo_uid="$(stat -c '%u' /app)"
repo_gid="$(stat -c '%g' /app)"
repo_home="/tmp/capakraken-dev-home"
# Cross-platform stat: GNU stat uses -c, BSD/macOS stat uses -f
if stat -c '%u' /app >/dev/null 2>&1; then
repo_uid="$(stat -c '%u' /app)"
repo_gid="$(stat -c '%g' /app)"
else
repo_uid="$(stat -f '%u' /app)"
repo_gid="$(stat -f '%g' /app)"
fi
mkdir -p /app/apps/web/.next
mkdir -p "$repo_home/.config/pnpm"
chown -R "$repo_uid:$repo_gid" /app/apps/web/.next
chown -R "$repo_uid:$repo_gid" "$repo_home"
exec setpriv --reuid="$repo_uid" --regid="$repo_gid" --clear-groups \
env HOME="$repo_home" XDG_CONFIG_HOME="$repo_home/.config" \
pnpm --filter @capakraken/web exec next dev -H 0.0.0.0 -p 3100
# Cross-platform privilege drop: setpriv (Linux) or su (macOS/BSD)
if command -v setpriv >/dev/null 2>&1; then
exec setpriv --reuid="$repo_uid" --regid="$repo_gid" --clear-groups \
env HOME="$repo_home" XDG_CONFIG_HOME="$repo_home/.config" \
pnpm --filter @capakraken/web exec next dev -H 0.0.0.0 -p 3100
else
exec su -s /bin/sh "#${repo_uid}" -c \
"HOME='$repo_home' XDG_CONFIG_HOME='$repo_home/.config' pnpm --filter @capakraken/web exec next dev -H 0.0.0.0 -p 3100"
fi