revert: [NPM] [CVEs] Revert Manual NPM Linux Dockerfile Package Installations #3680
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull Request Overview
This PR reverts the manual package installations in the NPM Linux Dockerfile that were previously added to address CVEs in Ubuntu. The changes remove explicit version pinning for several packages since the base image now contains the necessary security updates.
- Removed explicit version installation of libc-bin, libc6, libtasn1-6, and libgnutls30
- Relies on the updated Ubuntu base image for security patches
| /azp run Azure Container Networking PR |
| /azp run NPM Conformance Tests |
| Azure Pipelines successfully started running 1 pipeline(s). |
| /azp run NPM Scale Test |
| Azure Pipelines successfully started running 1 pipeline(s). |
1 similar comment
| Azure Pipelines successfully started running 1 pipeline(s). |
matmerr approved these changes May 23, 2025
vakalapa approved these changes May 23, 2025
rayaisaiah deleted the isaiahraya/npm-remove-hardcoded-package-installlations-master branch sivakami-projects pushed a commit that referenced this pull request Oct 23, 2025
…llations (#3680) removed manual package installations from npm dockerfile
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
Reason for Change:
Reverts manual package installations made to the NPM Linux dockerfile in: #3439 and #3461. These changes were made as NPM base image (Ubuntu) did not have the updated packages installed which lead to CVEs on the base image. Ubuntu has since been patched to have the CVEs resolved so there is no need to manually install the packages at a specific version.
Trivy scan of NPM linux with changes to dockerfile:
Issue Fixed:
Requirements:
Notes: