stjohnjohnson / smartthings-mqtt-bridge

Bridge between SmartThings and MQTT
https://hub.docker.com/r/stjohnjohnson/smartthings-mqtt-bridge/
MIT License
368 stars 243 forks source link

Use alpine image and update npm packages for x64 Dockerfile #150

Closed kenthua closed 6 years ago

kenthua commented 6 years ago

Without jumping into the code, switched the image to the node:alpine image, added npm package update via npm audit.

Current

found 16 vulnerabilities (8 low, 5 moderate, 2 high, 1 critical)
  run `npm audit fix` to fix them, or `npm audit` for details

Updated

fixed 12 of 16 vulnerabilities in 1100 scanned packages
  4 vulnerabilities required manual review and could not be updated
  4 package updates for 12 vulns involved breaking changes
  (installed due to `--force` option)
npm WARN express-joi-validator@2.0.0 requires a peer of joi@6.x.x but none is installed. You must install peer dependencies yourself.

audited 2923 packages in 5.62s
found 7 vulnerabilities (4 low, 3 moderate)

Image size 688MB -> 143MB

Tested image on local instance

kenthua commented 6 years ago

Since the original commits were not ideal, I updated the package.json with the vulnerable versions and removed the added npm commands in the Dockerfile.

stjohnjohnson commented 6 years ago

Just in case, published smartthings-mqtt-bridge@3.0.0 to account for the major Node version bump.

kenthua commented 6 years ago

+1