inventree/InvenTree
2
0
Fork 0
mirror of https://github.com/inventree/InvenTree.git synced 2025-04-27 19:16:44 +00:00
Code

fix: ci security issues (#9451)

Browse Source 
* fix possible code injection errors

* pin n
This commit is contained in:
Matthias Mair 2025-04-04 00:04:06 +02:00 committed by GitHub
parent a2370dbe59
commit 2712f30382
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.devcontainer/Dockerfile
View File

@ -34,7 +34,7 @@ RUN apt install -y \
yarn nodejs npm yarn nodejs npm
# Update to the latest stable node version # Update to the latest stable node version
RUN npm install -g n --ignore-scripts && n lts RUN npm install -g n@10.1.0 --ignore-scripts && n lts
RUN yarn config set network-timeout 600000 -g RUN yarn config set network-timeout 600000 -g

10
.github/actions/setup/action.yaml vendored
View File

@ -64,7 +64,9 @@ runs:
- name: Install Specific Python Dependencies - name: Install Specific Python Dependencies
if: ${{ inputs.pip-dependency }} if: ${{ inputs.pip-dependency }}
shell: bash shell: bash
run: uv pip install ${{ inputs.pip-dependency }} run: uv pip install ${PIP_DEPS}
env:
PIP_DEPS: ${{ inputs.pip-dependency }}
# NPM installs # NPM installs
- name: Install node.js ${{ env.node_version }} - name: Install node.js ${{ env.node_version }}
@ -78,8 +80,10 @@ runs:
shell: bash shell: bash
run: | run: |
sudo apt-get update sudo apt-get update
sudo apt-get install ${{ inputs.apt-dependency }} sudo apt-get install ${APT_DEPS}
sudo apt-get install ${{ inputs.apt-dependency }} sudo apt-get install ${APT_DEPS}
env:
APT_DEPS: ${{ inputs.apt-dependency }}
# Invoke commands # Invoke commands
- name: Install dev requirements - name: Install dev requirements

4
contrib/container/Dockerfile
View File

@ -108,7 +108,7 @@ RUN ./install_build_packages.sh --no-cache --virtual .build-deps && \
FROM prebuild AS frontend FROM prebuild AS frontend
RUN apk add --no-cache --update nodejs npm yarn bash RUN apk add --no-cache --update nodejs npm yarn bash
RUN npm install -g --ignore-scripts n RUN npm install -g --ignore-scripts n@10.1.0
RUN bash -c "n lts" RUN bash -c "n lts"
RUN yarn config set network-timeout 600000 -g RUN yarn config set network-timeout 600000 -g
COPY src ${INVENTREE_HOME}/src COPY src ${INVENTREE_HOME}/src
@ -152,7 +152,7 @@ RUN pip install --require-hashes -r base_requirements.txt --no-cache
# Install nodejs / npm / yarn # Install nodejs / npm / yarn
RUN apk add --no-cache --update nodejs npm yarn bash RUN apk add --no-cache --update nodejs npm yarn bash
RUN npm install -g --ignore-scripts n RUN npm install -g --ignore-scripts n@10.1.0
RUN bash -c "n lts" RUN bash -c "n lts"
RUN yarn config set network-timeout 600000 -g RUN yarn config set network-timeout 600000 -g