Skip to content

Conversation

lirantal
Copy link
Owner

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • docs/package.json

Vulnerabilities that will be fixed with an upgrade:

Issue Score
medium severity Allocation of Resources Without Limits or Throttling
SNYK-JS-AXIOS-12613773
  67  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AXIOS-12613773
@mergify mergify bot added the auto-merge label Sep 18, 2025
Copy link

qodo-merge-for-open-source bot commented Sep 18, 2025

CI Feedback 🧐

(Feedback updated until commit b4c77d2)

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: build_and_publish

Failed stage: Build and push Docker image [❌]

Failure summary:

The action failed during the Docker build step at Dockerfile:14 (RUN npm ci) because npm ci detected
that package.json and the lockfile are out of sync:
- Error: cipm can only install packages when
your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock
file with npm install before continuing.
- Specific mismatch: lockfile has [email protected]
which does not satisfy the required lockfile-lint@^4.12.0.
- Fix by updating the lock file (run npm
install locally to regenerate package-lock.json to match package.json) and commit the updated
lockfile.

Relevant error logs:
1:  ##[group]Runner Image Provisioner
2:  Hosted Compute Agent
...

722:  #7 2.914 OK: 238 MiB in 30 packages
723:  #7 DONE 3.3s
724:  #8 [3/5] COPY . /app
725:  #8 DONE 0.1s
726:  #9 [4/5] WORKDIR /app
727:  #9 DONE 0.0s
728:  #10 [5/5] RUN npm ci
729:  #10 0.621 npm ERR! cipm can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
730:  #10 0.621 npm ERR! 
731:  #10 0.621 npm ERR! 
732:  #10 0.621 npm ERR! Invalid: lock file's [email protected] does not satisfy lockfile-lint@^4.12.0
733:  #10 0.621 npm ERR! 
734:  #10 0.624 
735:  #10 0.624 npm ERR! A complete log of this run can be found in:
736:  #10 0.624 npm ERR!     /root/.npm/_logs/2025-09-18T07_00_58_037Z-debug.log
737:  #10 ERROR: process "/bin/sh -c npm ci" did not complete successfully: exit code: 1
738:  ------
...

746:  0.624 npm ERR! A complete log of this run can be found in:
747:  0.624 npm ERR!     /root/.npm/_logs/2025-09-18T07_00_58_037Z-debug.log
748:  ------
749:  �[33m3 warnings found (use docker --debug to expand):
750:  �[0m - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 8)
751:  - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 9)
752:  - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 13)
753:  Dockerfile:14
754:  --------------------
755:  12 |     WORKDIR /app
756:  13 |     ENV NODE_ENV production
757:  14 | >>> RUN npm ci
758:  15 |     
759:  16 |     ENTRYPOINT ["node", "index.js"]
760:  --------------------
761:  ERROR: failed to build: failed to solve: process "/bin/sh -c npm ci" did not complete successfully: exit code: 1
762:  ##[error]buildx call failed with: ERROR: failed to build: failed to solve: process "/bin/sh -c npm ci" did not complete successfully: exit code: 1
763:  Post job cleanup.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants