[Snyk] Security upgrade dockerode from 3.3.5 to 4.0.5

[lirantal]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Improper Link Resolution Before File Access ('Link Following') SNYK-JS-TARFS-10293725	721

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Link Resolution Before File Access ('Link Following')

[qodo-merge-for-open-source]

CI Feedback 🧐

(Feedback updated until commit c5832ff)

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: build_and_publish

Failed stage: Build and push Docker image [❌]

Failure summary: The Docker build failed during the npm ci command execution. The failure occurred because: • The package.json and package-lock.json files are out of sync • The lock file contains outdated versions that don't match the current package.json requirements: - [email protected] in lock file vs [email protected] required - [email protected] in lock file vs lockfile-lint@^4.12.0 required • The npm ci command requires synchronized lock files and cannot proceed with mismatched versions

Relevant error logs: 1: ##[group]Operating System 2: Ubuntu ... 761: #7 DONE 3.4s 762: #8 [3/5] COPY . /app 763: #8 DONE 0.1s 764: #9 [4/5] WORKDIR /app 765: #9 DONE 0.0s 766: #10 [5/5] RUN npm ci 767: #10 0.627 npm ERR! cipm can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing. 768: #10 0.627 npm ERR! 769: #10 0.627 npm ERR! 770: #10 0.627 npm ERR! Invalid: lock file's [email protected] does not satisfy [email protected] 771: #10 0.627 npm ERR! Invalid: lock file's [email protected] does not satisfy lockfile-lint@^4.12.0 772: #10 0.627 npm ERR! 773: #10 0.631 774: #10 0.631 npm ERR! A complete log of this run can be found in: 775: #10 0.631 npm ERR! /root/.npm/_logs/2025-06-21T08_36_27_086Z-debug.log 776: #10 ERROR: process "/bin/sh -c npm ci" did not complete successfully: exit code: 1 777: ------ ... 786: 0.631 npm ERR! A complete log of this run can be found in: 787: 0.631 npm ERR! /root/.npm/_logs/2025-06-21T08_36_27_086Z-debug.log 788: ------ 789: �[33m3 warnings found (use docker --debug to expand): 790: �[0m - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 9) 791: - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 13) 792: - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 8) 793: Dockerfile:14 794: -------------------- 795: 12 | WORKDIR /app 796: 13 | ENV NODE_ENV production 797: 14 | >>> RUN npm ci 798: 15 | 799: 16 | ENTRYPOINT ["node", "index.js"] 800: -------------------- 801: ERROR: failed to solve: process "/bin/sh -c npm ci" did not complete successfully: exit code: 1 802: ##[error]buildx failed with: ERROR: failed to solve: process "/bin/sh -c npm ci" did not complete successfully: exit code: 1 803: Post job cleanup.