Skip to content

chore(build): bump base image and security improvement - #282

Merged
yhabib merged 8 commits into
mainfrom
chore/bump-base-image-and-node
Mar 5, 2026
Merged

yhabib merged 8 commits into
mainfrom
chore/bump-base-image-and-node

Conversation

@yhabib

@yhabib yhabib commented Mar 3, 2026 •

Copy link
Copy Markdown
Collaborator

Motivation

The new base image uses the latest version of Node. This enables a security feature called minimumReleaseAge, which prevents the package from installing packages that are not older than 7 days.

Note 1: Some dependencies still do not support eslint@10, so overrides have been added to package.json.

Note 2: Relevant topic for enabling whitelists for the new security flag to hotfix dependencies.

Changes

  • Bumped Node.js from 24.11.0 to 25.8.0 in .nvmrc andpackage.json engines.
  • Bumped the builder-base image tag from 0.0.8 to 0.0.9.
  • Added min-release-age=7 to .npmrc to avoid installing packages published less than 7 days ago.
  • Regenerated package-lock.json.

@github-actions

github-actions Bot commented Mar 3, 2026 •

Copy link
Copy Markdown

📊 Build Bundle Stats

The latest build generated the following assets:

dist/index.html                                           1.90 kB │ gzip:   0.68 kB
dist/assets/index-_vSANtJq.css                          125.69 kB │ gzip:  19.86 kB
dist/assets/neuron-CjvOx6OV.js                            0.08 kB │ gzip:   0.09 kB
dist/assets/externalServices-CyoGFp16.js                  0.24 kB │ gzip:   0.18 kB
dist/assets/findFollowedNeuron-Ch_yEa4H.js                0.32 kB │ gzip:   0.24 kB
dist/assets/service-BEMuDwbo.js                           0.60 kB │ gzip:   0.39 kB
dist/assets/numbers-DZLSpKr9.js                           0.61 kB │ gzip:   0.37 kB
dist/assets/useTvlValue-CxrEaPyV.js                       0.64 kB │ gzip:   0.44 kB
dist/assets/useIcpIndex-CJgXdnPM.js                       0.71 kB │ gzip:   0.45 kB
dist/assets/PageHeader-Cr3cEbbs.js                        0.75 kB │ gzip:   0.44 kB
dist/assets/Separator-L1jlteYm.js                         0.77 kB │ gzip:   0.45 kB
dist/assets/CertifiedBadge-Dp3RjUaq.js                    0.80 kB │ gzip:   0.48 kB
dist/assets/useGovernanceKnownNeurons-D5kUCXuA.js         0.91 kB │ gzip:   0.58 kB
dist/assets/Badge-CI1dF5Tx.js                             1.65 kB │ gzip:   0.81 kB
dist/assets/useIcpSwapPrices-DzQVcC-5.js                  1.72 kB │ gzip:   0.94 kB
dist/assets/QueryStates-DehSFjR1.js                       1.86 kB │ gzip:   0.83 kB
dist/assets/Tooltip-CNlkbG5o.js                           1.89 kB │ gzip:   0.86 kB
dist/assets/useInfiniteQueryThenUpdateCall-ZUOG8ANA.js    1.93 kB │ gzip:   0.96 kB
dist/assets/Card-CAikxzjH.js                              2.18 kB │ gzip:   0.58 kB
dist/assets/useVoting-B4TIApen.js                         2.38 kB │ gzip:   1.24 kB
dist/assets/Alert-C1Tq3qPW.js                             2.45 kB │ gzip:   0.92 kB
dist/assets/CopyButton-pQgxRAyr.js                        2.80 kB │ gzip:   1.28 kB
dist/assets/ToggleGroup-C_-TViAx.js                       3.05 kB │ gzip:   1.33 kB
dist/assets/_auth-DXdlqyO1.js                             3.39 kB │ gzip:   1.74 kB
dist/assets/MarkdownRenderer-V5nPEnNQ.js                  3.45 kB │ gzip:   1.61 kB
dist/assets/AlertDialog-CFiYZN2i.js                       3.64 kB │ gzip:   0.97 kB
dist/assets/Spinner-BoF9xE7q.js                           4.73 kB │ gzip:   2.18 kB
dist/assets/index-DNs_MIfL.js                             8.29 kB │ gzip:   3.23 kB
dist/assets/index-D730Zp_7.js                            12.82 kB │ gzip:   3.98 kB
dist/assets/AmountInput-URVpE7Fr.js                      14.06 kB │ gzip:   5.81 kB
dist/assets/index-B91GVbpE.js                            16.38 kB │ gzip:   5.49 kB
dist/assets/index-DvGPTV9R.js                            18.52 kB │ gzip:   7.03 kB
dist/assets/index-eamHneUI.js                            40.25 kB │ gzip:  11.89 kB
dist/assets/index-DSwAdx-M.js                            70.23 kB │ gzip:  22.92 kB
dist/assets/index-m7xdTdtT.js                            89.02 kB │ gzip:  30.01 kB
dist/assets/vendor-md-DOIs8GWw.js                        89.32 kB │ gzip:  25.51 kB
dist/assets/index-DmYlFfBr.js                           115.62 kB │ gzip:  32.77 kB
dist/assets/vendor-tanstack-BmOWCIZ0.js                 123.44 kB │ gzip:  38.35 kB
dist/assets/vendor-core-react-By6K7kM9.js               193.24 kB │ gzip:  60.69 kB
dist/assets/vendor-recharts-BE3_JuSf.js                 228.10 kB │ gzip:  65.92 kB
dist/assets/vendor-icp-B37zDZq_.js                      402.36 kB │ gzip: 100.05 kB
dist/assets/vendor-libs-Bdate15X.js                     531.89 kB │ gzip: 176.03 kB

@yhabib
yhabib force-pushed the chore/bump-base-image-and-node branch 3 times, most recently from 678390f to 72233a6 Compare March 3, 2026 12:56
@yhabib
yhabib marked this pull request as ready for review March 3, 2026 13:02
@yhabib
yhabib requested a review from a team as a code owner March 3, 2026 13:02
Comment thread .nvmrc Resolved
Comment thread package.json Resolved

@0xFFrancesco 0xFFrancesco left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As discussed, unless there is an immediate need for this change to be merged, I think we should before update the NNS-dapp and keep the node versions in sync 😄

@yhabib
yhabib force-pushed the chore/bump-base-image-and-node branch from 72233a6 to 0b3b6cc Compare March 4, 2026 13:15
Base automatically changed from chore/docker-base-image to main March 5, 2026 09:11
@yhabib

yhabib commented Mar 5, 2026

Copy link
Copy Markdown
Collaborator Author

As discussed, unless there is an immediate need for this change to be merged, I think we should before update the NNS-dapp and keep the node versions in sync 😄

nns-dapp PR: dfinity/nns-dapp#7764

@yhabib
yhabib force-pushed the chore/bump-base-image-and-node branch from 8b20b8d to 6e20004 Compare March 5, 2026 09:18
@yhabib
yhabib added this pull request to the merge queue Mar 5, 2026
Merged via the queue into main with commit 5e18d7b Mar 5, 2026
6 checks passed
@yhabib
yhabib deleted the chore/bump-base-image-and-node branch March 5, 2026 09:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants