nicktrn
16d59aa9e7
Hardens the webapp Docker image and adds a CVE scan of each published image. - Base image `bullseye-slim` → `bookworm-slim` (Debian 12), pinned by digest. Adds `apt-get upgrade` + `--no-install-recommends` + apt-cache cleanup across the build stages so OS packages are patched at build time. - Moves the `react-email` CLI to `devDependencies` in `internal-packages/emails` — only the `email dev` preview script uses it; the runtime render path is `@react-email/render` + `@react-email/components`. This also drops the bundled `esbuild` binary from the production image. - Bumps `goose` v3.26.0 → v3.27.1 and its Go builder image 1.23 → 1.26. - Adds a reusable Trivy image-scan workflow wired into `publish.yml`, so every published image (main builds and releases) is scanned for OS-package CVEs right after it's pushed to GHCR. Report-only (writes to the run summary), runs alongside the worker publishes so it never blocks a deploy. Verified locally: the image builds clean on the new base, and `@react-email/render` carries no `esbuild` dependency so email rendering is unaffected.
33 lines
741 B
JSON
33 lines
741 B
JSON
{
|
|
"private": true,
|
|
"name": "emails",
|
|
"version": "1.0.0",
|
|
"description": "Send emails",
|
|
"main": "./src/index.tsx",
|
|
"types": "./src/index.tsx",
|
|
"scripts": {
|
|
"dev": "PORT=3080 email dev",
|
|
"typecheck": "tsc --noEmit"
|
|
},
|
|
"dependencies": {
|
|
"@aws-sdk/client-sesv2": "^3.716.0",
|
|
"@react-email/components": "1.0.12",
|
|
"@react-email/render": "^2.0.8",
|
|
"nodemailer": "^8.0.6",
|
|
"react": "^18.2.0",
|
|
"react-dom": "^18.2.0",
|
|
"resend": "^3.2.0",
|
|
"tiny-invariant": "^1.2.0",
|
|
"zod": "3.25.76"
|
|
},
|
|
"devDependencies": {
|
|
"@types/nodemailer": "^8.0.0",
|
|
"@types/react": "18.2.69",
|
|
"@types/react-dom": "18.2.7",
|
|
"react-email": "^6.5.0"
|
|
},
|
|
"engines": {
|
|
"node": ">=18.0.0"
|
|
}
|
|
}
|