Skip to content

Initial commit: Trivy scanning test repository#1

Open
mpastecki wants to merge 12 commits intomainfrom
feat1
Open

Initial commit: Trivy scanning test repository#1
mpastecki wants to merge 12 commits intomainfrom
feat1

Conversation

@mpastecki
Copy link
Collaborator

@mpastecki mpastecki commented Jan 27, 2026

No description provided.

Copilot AI review requested due to automatic review settings January 27, 2026 14:19
Copilot AI reviewed Jan 27, 2026
View reviewed changes
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@github-advanced-security
Copy link

github-advanced-security bot commented Jan 27, 2026

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 27, 2026
View reviewed changes
Dockerfile
WORKDIR /app

COPY package*.json ./
ADD package*.json ./

Check failure

Code scanning / Hadolint

Use COPY instead of ADD for files and folders Error

Use COPY instead of ADD for files and folders
Dockerfile

COPY tsconfig.json ./
COPY src ./src
ADD tsconfig.json ./

Check failure

Code scanning / Hadolint

Use COPY instead of ADD for files and folders Error

Use COPY instead of ADD for files and folders
Dockerfile
COPY tsconfig.json ./
COPY src ./src
ADD tsconfig.json ./
ADD src ./src

Check failure

Code scanning / Hadolint

Use COPY instead of ADD for files and folders Error

Use COPY instead of ADD for files and folders
Dockerfile
# Build stage
FROM node:20-alpine AS builder
# Build stage - intentionally bad for Hadolint testing
FROM node:latest AS builder

Check warning

Code scanning / Hadolint

Using latest is prone to errors if the image will ever update. Pin the version explicitly to a release tag Warning

Using latest is prone to errors if the image will ever update. Pin the version explicitly to a release tag
Dockerfile
# Build stage - intentionally bad for Hadolint testing
FROM node:latest AS builder

RUN cd /app || mkdir /app

Check warning

Code scanning / Hadolint

Use WORKDIR to switch to a directory Warning

Use WORKDIR to switch to a directory
Dockerfile
# Production stage
FROM node:20-alpine

RUN apk add curl wget

Check warning

Code scanning / Hadolint

Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> Warning

Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>
Dockerfile
EXPOSE 3000

CMD ["node", "dist/index.js"]
CMD node dist/index.js

Check warning

Code scanning / Hadolint

Use arguments JSON notation for CMD and ENTRYPOINT arguments Warning

Use arguments JSON notation for CMD and ENTRYPOINT arguments
Dockerfile
# Production stage
FROM node:20-alpine

RUN apk add curl wget

Check notice

Code scanning / Hadolint

Use the --no-cache switch to avoid the need to use --update and remove /var/cache/apk/* when done installing packages Note

Use the --no-cache switch to avoid the need to use --update and remove /var/cache/apk/* when done installing packages
github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 27, 2026
View reviewed changes
package-lock.json
Comment on lines +162 to +170
"node_modules/axios": {
"version": "0.21.1",
"resolved": "https://registry.npmjs.org/axios/-/axios-0.21.1.tgz",
"integrity": "sha512-dKQiRHxGD9PPRIUNIWvZhPTPpl1rf/OxTYKsqKUDjBwYylTvV7SjSHJb9ratfyzM6wCdLCOYLzs73qpg5c4iGA==",
"license": "MIT",
"dependencies": {
"follow-redirects": "^1.10.0"
}
},

Check failure

Code scanning / Trivy

nodejs-axios: Regular expression denial of service in trim function High

Package: axios
Installed Version: 0.21.1
Vulnerability CVE-2021-3749
Severity: HIGH
Fixed Version: 0.21.2
Link: CVE-2021-3749
package-lock.json
Comment on lines +162 to +170
"node_modules/axios": {
"version": "0.21.1",
"resolved": "https://registry.npmjs.org/axios/-/axios-0.21.1.tgz",
"integrity": "sha512-dKQiRHxGD9PPRIUNIWvZhPTPpl1rf/OxTYKsqKUDjBwYylTvV7SjSHJb9ratfyzM6wCdLCOYLzs73qpg5c4iGA==",
"license": "MIT",
"dependencies": {
"follow-redirects": "^1.10.0"
}
},

Check failure

Code scanning / Trivy

axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests High

Package: axios
Installed Version: 0.21.1
Vulnerability CVE-2025-27152
Severity: HIGH
Fixed Version: 1.8.2, 0.30.0
Link: CVE-2025-27152
package-lock.json
Comment on lines +617 to +638
"node_modules/jsonwebtoken": {
"version": "8.5.1",
"resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz",
"integrity": "sha512-XjwVfRS6jTMsqYs0EsuJ4LGxXV14zQybNd4L2r0UvbVnSF9Af8x7p5MzbJ90Ioz/9TI41/hTCvznF/loiSzn8w==",
"license": "MIT",
"dependencies": {
"jws": "^3.2.2",
"lodash.includes": "^4.3.0",
"lodash.isboolean": "^3.0.3",
"lodash.isinteger": "^4.0.4",
"lodash.isnumber": "^3.0.3",
"lodash.isplainobject": "^4.0.6",
"lodash.isstring": "^4.0.1",
"lodash.once": "^4.0.0",
"ms": "^2.1.1",
"semver": "^5.6.0"
},
"engines": {
"node": ">=4",
"npm": ">=1.4.28"
}
},

Check failure

Code scanning / Trivy

jsonwebtoken: Unrestricted key type could lead to legacy keys usagen High

Package: jsonwebtoken
Installed Version: 8.5.1
Vulnerability CVE-2022-23539
Severity: HIGH
Fixed Version: 9.0.0
Link: CVE-2022-23539
package-lock.json
Comment on lines +666 to +671
"node_modules/lodash": {
"version": "4.17.20",
"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz",
"integrity": "sha512-PlhdFcillOINfeV7Ni6oF1TAEayyZBoZ8bcshTHqOYJYlrqzRK5hagpagky5o4HfCzzd1TRkXPMFq6cKk9rGmA==",
"license": "MIT"
},

Check failure

Code scanning / Trivy

nodejs-lodash: command injection via template High

Package: lodash
Installed Version: 4.17.20
Vulnerability CVE-2021-23337
Severity: HIGH
Fixed Version: 4.17.21
Link: CVE-2021-23337
package-lock.json
Comment on lines +162 to +170
"node_modules/axios": {
"version": "0.21.1",
"resolved": "https://registry.npmjs.org/axios/-/axios-0.21.1.tgz",
"integrity": "sha512-dKQiRHxGD9PPRIUNIWvZhPTPpl1rf/OxTYKsqKUDjBwYylTvV7SjSHJb9ratfyzM6wCdLCOYLzs73qpg5c4iGA==",
"license": "MIT",
"dependencies": {
"follow-redirects": "^1.10.0"
}
},

Check warning

Code scanning / Trivy

axios: exposure of confidential data stored in cookies Medium

Package: axios
Installed Version: 0.21.1
Vulnerability CVE-2023-45857
Severity: MEDIUM
Fixed Version: 1.6.0, 0.28.0
Link: CVE-2023-45857
package-lock.json
Comment on lines +617 to +638
"node_modules/jsonwebtoken": {
"version": "8.5.1",
"resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz",
"integrity": "sha512-XjwVfRS6jTMsqYs0EsuJ4LGxXV14zQybNd4L2r0UvbVnSF9Af8x7p5MzbJ90Ioz/9TI41/hTCvznF/loiSzn8w==",
"license": "MIT",
"dependencies": {
"jws": "^3.2.2",
"lodash.includes": "^4.3.0",
"lodash.isboolean": "^3.0.3",
"lodash.isinteger": "^4.0.4",
"lodash.isnumber": "^3.0.3",
"lodash.isplainobject": "^4.0.6",
"lodash.isstring": "^4.0.1",
"lodash.once": "^4.0.0",
"ms": "^2.1.1",
"semver": "^5.6.0"
},
"engines": {
"node": ">=4",
"npm": ">=1.4.28"
}
},

Check warning

Code scanning / Trivy

jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass Medium

Package: jsonwebtoken
Installed Version: 8.5.1
Vulnerability CVE-2022-23540
Severity: MEDIUM
Fixed Version: 9.0.0
Link: CVE-2022-23540
package-lock.json
Comment on lines +617 to +638
"node_modules/jsonwebtoken": {
"version": "8.5.1",
"resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz",
"integrity": "sha512-XjwVfRS6jTMsqYs0EsuJ4LGxXV14zQybNd4L2r0UvbVnSF9Af8x7p5MzbJ90Ioz/9TI41/hTCvznF/loiSzn8w==",
"license": "MIT",
"dependencies": {
"jws": "^3.2.2",
"lodash.includes": "^4.3.0",
"lodash.isboolean": "^3.0.3",
"lodash.isinteger": "^4.0.4",
"lodash.isnumber": "^3.0.3",
"lodash.isplainobject": "^4.0.6",
"lodash.isstring": "^4.0.1",
"lodash.once": "^4.0.0",
"ms": "^2.1.1",
"semver": "^5.6.0"
},
"engines": {
"node": ">=4",
"npm": ">=1.4.28"
}
},

Check warning

Code scanning / Trivy

jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC Medium

Package: jsonwebtoken
Installed Version: 8.5.1
Vulnerability CVE-2022-23541
Severity: MEDIUM
Fixed Version: 9.0.0
Link: CVE-2022-23541
package-lock.json
Comment on lines +666 to +671
"node_modules/lodash": {
"version": "4.17.20",
"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz",
"integrity": "sha512-PlhdFcillOINfeV7Ni6oF1TAEayyZBoZ8bcshTHqOYJYlrqzRK5hagpagky5o4HfCzzd1TRkXPMFq6cKk9rGmA==",
"license": "MIT"
},

Check warning

Code scanning / Trivy

nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions Medium

Package: lodash
Installed Version: 4.17.20
Vulnerability CVE-2020-28500
Severity: MEDIUM
Fixed Version: 4.17.21
Link: CVE-2020-28500
package-lock.json
Comment on lines +666 to +671
"node_modules/lodash": {
"version": "4.17.20",
"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz",
"integrity": "sha512-PlhdFcillOINfeV7Ni6oF1TAEayyZBoZ8bcshTHqOYJYlrqzRK5hagpagky5o4HfCzzd1TRkXPMFq6cKk9rGmA==",
"license": "MIT"
},

Check warning

Code scanning / Trivy

lodash: prototype pollution in _.unset and _.omit functions Medium

Package: lodash
Installed Version: 4.17.20
Vulnerability CVE-2025-13465
Severity: MEDIUM
Fixed Version: 4.17.23
Link: CVE-2025-13465
maiquanghiep
maiquanghiep previously approved these changes Jan 28, 2026
View reviewed changes
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@maiquanghiep maiquanghiep maiquanghiep left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@mpastecki @maiquanghiep