chore: dependency refresh, image hardening and tooling alignment

.dockerignore

@@ -0,0 +1,6 @@
+**/node_modules
+**/dist
+ui/dts
+.env
+data
+.git

.github/workflows/releases.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - id: get_version
-      uses: battila7/get-version-action@v2
+      run: echo "major=$(echo "${GITHUB_REF_NAME#v}" | cut -d. -f1)" >> "$GITHUB_OUTPUT"
 
     - name: Send Keel notifications to koumoul.com
       run: |

.github/workflows/reuse-build.yml

@@ -8,13 +8,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout git repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v7
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@v4
 
     - name: Login to Github container registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@v4
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
@@ -27,7 +27,7 @@ jobs:
 
     - name: Prepare docker tags for main image
       id: docker_meta_main
-      uses: docker/metadata-action@v5
+      uses: docker/metadata-action@v6
       with:
         images: ghcr.io/${{ github.repository }}
         tags: |
@@ -39,7 +39,7 @@ jobs:
 
     - name: Build and push main image
       id: docker_build_main
-      uses: docker/build-push-action@v5
+      uses: docker/build-push-action@v7
       with:
         context: .
         push: true

.github/workflows/reuse-quality.yml

@@ -8,9 +8,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout git repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v7
 
-    - uses: actions/setup-node@v5
+    - uses: actions/setup-node@v7
       with:
         node-version: 24
         cache: 'npm'

.husky/commit-msg

@@ -1 +1 @@
-npx --no-install commitlint --edit ""
+npx --no -- commitlint --edit "$1"

Dockerfile

@@ -1,8 +1,9 @@
 # =============================
 # Base Node image
 # =============================
-FROM node:24.11.1-alpine3.22 AS base
+FROM node:24.22.0-alpine3.24 AS base
 
+RUN apk upgrade --no-cache
 WORKDIR /app
 ENV NODE_ENV=production
 
@@ -46,7 +47,6 @@ RUN npm run build-types
 # =============================
 FROM installer AS ui
 
-RUN npm i --no-save @rollup/rollup-linux-x64-musl
 COPY --from=types /app/api/config api/config
 COPY --from=types /app/api/types api/types
 ADD /api/src/config.ts api/src/config.ts
@@ -68,6 +68,9 @@ RUN mkdir -p /app/api/node_modules
 # =============================
 FROM base AS main
 
+# npm, corepack and yarn are never used at runtime and carry their own CVEs
+RUN rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /opt/yarn-* /usr/local/bin/yarn /usr/local/bin/yarnpkg
+
 COPY --from=api-installer /app/node_modules node_modules
 COPY api api
 COPY --from=types /app/api/config api/config

api/package.json

@@ -11,7 +11,7 @@
   "dependencies": {
     "@data-fair/lib-express": "^1.27.0",
     "@data-fair/lib-node": "^2.12.1",
-    "config": "^3.3.12",
+    "config": "^5.0.1",
     "express": "^5.0.1",
     "http-terminator": "^3.2.0",
     "prom-client": "^15.1.3"

api/src/admin/router.ts

@@ -12,9 +12,13 @@ router.use(async (req, res, next) => {
   next()
 })
 
-let info = { version: process.env.NODE_ENV }
+let info: Record<string, string> = { version: process.env.NODE_ENV ?? 'development' }
 if (process.env.NODE_ENV === 'production') {
-  info = JSON.parse(await readFile(resolve(import.meta.dirname, '../../../BUILD.json'), 'utf8'))
+  try {
+    info = JSON.parse(await readFile(resolve(import.meta.dirname, '../../../BUILD.json'), 'utf8'))
+  } catch {
+    info = { version: 'unknown (built without CI)' }
+  }
 }
 router.get('/info', (req, res) => {
   res.send(info)

api/src/config.ts

@@ -3,7 +3,6 @@ import { assertValid } from '../config/type/index.ts'
 import config from 'config'
 
 // we reload the config instead of using the singleton from the config module for testing purposes
-// @ts-ignore
 const apiConfig = process.env.NODE_ENV === 'test' ? config.util.loadFileConfigs(process.env.NODE_CONFIG_DIR, { skipConfigSources: true }) : config
 assertValid(apiConfig, { lang: 'en', name: 'config', internal: true })
 

commitlint.config.ts

@@ -0,0 +1 @@
+export default { extends: ['@commitlint/config-conventional'] }