Package vulnerability audit dec 2024 (#190)

* Updated python docker images to gracefuly stop since they now start in the primary process in a container, through taking over execution of the entrypoint script via a command;

* Increased python-multipart pacakge version to avoid vulnerability;

* increased eslint's version to remove dependency which has vulnerability; this required upgrading the eslint configuration within rosalution to use the new flat file configuration.  It is temporarily tuned to be close to the existing code base linting however, the team will review and revise linting guidelines when we gather soon.

* @stylistic/eslint-plugin-js@2.12.1 requires 20.9 & higher; after investigating, in order to avoid the vulnerably also being inside the docker images, need to upgrade to both alpine3.21 & 23.4.;

* Linting upgrade for eslint to 9.16  for system tests & some updates to corresponding tests.

* Resolved unit test text formatting issue; updated system test package.json to indicate its of type module for JavaScript.

* Updated system test with finicky rendering of context menus for test

* Upping vite to 6.0.3 to resolve vulnerabilities and update its dependencies that have vulnerabilities

* Updated to support attaching genbank .gb files

* Forced package resolutions to avoid the vulnerabilities

Author: SeriousHorncat

.github/workflows/nodejs.yml

@@ -14,7 +14,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [20.8]
+        node-version: [23.4]
 
     steps:
     - uses: actions/checkout@v4

CHANGELOG.md

@@ -12,10 +12,17 @@ using OpenCravat. VCF string provided by Ensembl's API is cached in the MongoDB
 Variant annotations were rendering vertically and it was taking too much space.
 - Analyses have a version manifest of annotation's dataset, source, and version
 - Increased VueJS version to 3.5.12 to use TemplateRef as a feature
+- Added support for attaching genbank (.gb) files for supporting evidence attachments
+
+### Development
+
+- Minimum NodeJS version increased to v23.4 to support upgrading package dependencies to avoid reported vulnerabilities
+- ESlint upgrade to 9 and migrating configuration to flat file config
 
 ### Bugs
 
 - Fixed developer API endpoint so that existing analyses can queue their annotations to be rendered again if desired.
+- Backend starts takes over the shell process allowing it to receive SIGTERM for graceful shutdown
 
 ## 0.7.0
 

README.md

@@ -56,7 +56,7 @@ The following pre-requisites are required to be installed in the target *NIX env
 deploying and testing Rosalution. Install environment dependencies below using
 the respective installation instructions for your target environment.
 
-- [Node.JS 20.8+](https://nodejs.org/en/) & [Classic Yarn](https://classic.yarnpkg.com/en/)
+- [Node.JS 23.4+](https://nodejs.org/en/) & [Classic Yarn](https://classic.yarnpkg.com/en/)
     - Node.JS recommends managing Node.JS installations with [nvm](https://www.npmjs.com/package/npx) - [install](https://github.com/nvm-sh/nvm#install--update-script)
     - Yarn is not included with Node.JS with `nvm`. Run `npm install --global yarn` once Node.JS is installed. - [install](https://classic.yarnpkg.com/en/docs/install)
 - [Python 3.11+](https://www.python.org/) - [Install](https://www.python.org/downloads/)

backend/Dockerfile

@@ -4,7 +4,7 @@ WORKDIR /app
 COPY requirements.txt /app/requirements.txt
 RUN pip install --no-cache-dir --upgrade -r /app/requirements.txt
 COPY ./src /app/src
-ENTRYPOINT ["/bin/sh", "-c", "uvicorn src.main:app --host 0.0.0.0 --port 8000 --log-level info --reload"]
+CMD ["uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8000", "--log-level", "info", "--reload"]
 
 # Production Build Stage
 FROM python:3.11-slim-bookworm AS production-stage
@@ -15,4 +15,4 @@ RUN pip install --no-cache-dir -r /app/requirements.txt
 COPY ./src /app/src
 COPY etc/entrypoint-init.sh /app/entrypoint-init.sh
 RUN rm /app/src/routers/dev_router.py
-ENTRYPOINT ["/bin/sh", "-c", "uvicorn src.main:app --host 0.0.0.0 --port 8000 --log-level info"]
+CMD ["uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8000", "--log-level", "info"]

backend/etc/entrypoint-init.sh

@@ -6,5 +6,6 @@ if [ "$ROSALUTION_ENV" = "production" ]; then
    DEBUG='-O'
 fi
 
-ROSALUTION_KEY="$(< /dev/urandom tr -dc A-Za-z0-9  | head -c 65)" && export ROSALUTION_KEY && \
-   python $DEBUG -m uvicorn src.main:app --host 0.0.0.0 --port 8000 --log-level info "$@"
+ROSALUTION_KEY="$(< /dev/urandom tr -dc A-Za-z0-9  | head -c 65)" && export ROSALUTION_KEY
+
+exec python $DEBUG -m uvicorn src.main:app --host 0.0.0.0 --port 8000 --log-level info "$@"

backend/requirements.txt

@@ -5,7 +5,7 @@ itsdangerous==2.1.2
 pymongo==4.6.3
 jq==1.6.0
 
-python-multipart==0.0.7
+python-multipart==0.0.18
 PyJWT[crypto]==2.8.0
 bcrypt==4.2.0
 

docker-compose.local-production.yml

@@ -52,7 +52,7 @@ services:
     environment:
       - ROSALUTION_ENV=production
       - MONGODB_HOST=rosalution-db
-    entrypoint: ['/bin/sh', '-c', './entrypoint-init.sh']
+    command: ['./etc/entrypoint-init.sh']
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=rosalution-network"

docker-compose.staging.yml

@@ -24,7 +24,7 @@ services:
       - ROSALUTION_ENV=production
       - MONGODB_HOST=rosalution-db
       - CAS_LOGIN_ENABLE=True
-    entrypoint: ['/bin/sh', '-c', './entrypoint-init.sh']
+    command: ['./etc/entrypoint-init.sh']
     deploy:
       labels:
         - "traefik.enable=true"

docker-compose.yml

@@ -57,7 +57,7 @@ services:
       - ./backend:/app
     environment:
       - MONGODB_HOST=rosalution-db
-    entrypoint: ['/bin/sh', '-c', './etc/entrypoint-init.sh --reload']
+    command: ['./etc/entrypoint-init.sh', '--reload']
     networks:
       - rosalution-network
     labels:

etc/fixtures/production.Dockerfile

@@ -1,3 +1,3 @@
-FROM mongo:5.0.9 as production-stage
+FROM mongo:5.0.9 AS production-stage
 COPY --chmod=0777 ./initial-seed/initial-db-seed.sh /docker-entrypoint-initdb.d/initial-db-seed.sh
 COPY ./initial-seed/ /tmp/fixtures/initial-seed/