mirror of
https://gh-proxy.org/https://github.com/klinsmaya/multica.git
synced 2026-11-08 01:16:45 +08:00
ef2d2b3e48
* fix(web): pin Dockerfile.web to node:22.23.4-alpine for Oct 2026 Node security release (MUL-8149) Co-authored-by: multica-agent <[email protected]> * fix(desktop): upgrade Electron 39 (EOL) to 44.9.3 (MUL-8149) Electron 39 is end-of-life and will not receive the 2026-10-21 Node.js security fixes. 44.x is a supported line (Node 24.22.0, Chromium 152). clipboard.writeText now returns a Promise in Electron 44; handle the rejection in the context menu so it can't become an unhandled rejection. Co-authored-by: multica-agent <[email protected]> * fix(desktop): skip auto-update on macOS 12 and older (MUL-8149) Electron 44 requires macOS 13 (Darwin 22), but electron-builder does not publish minimumSystemVersion in latest-mac.yml, so electron-updater would download and install a build that cannot launch on macOS 12, replacing a working app. Disable background checks/downloads on those hosts and make a manual check report the OS requirement instead. Co-authored-by: multica-agent <[email protected]> * fix(desktop): publish macOS update floor in update metadata (MUL-8149) Review feedback: installed macOS 12 clients run their old updater code, so a runtime check in the new build can never stop them from downloading an Electron 44 build that cannot launch. The guard has to live in the published latest-mac.yml / latest-x64-mac.yml. - beforePack hook (scripts/mac-update-floor.cjs) adds minimumSystemVersion: 22.0.0 (Darwin kernel, = macOS 13) to the mac releaseInfo that electron-builder spreads into update info. The config schema rejects the key, so it is set on the packager after validation; the hook throws if those internals move. - mac.minimumSystemVersion: 13.0.0 for every mac bundle; drop the stale Intel-only 12.0.0 override in package.mjs. - Regression test runs electron-updater 6.8.3's real checkIfUpdateSupported against the published shape: Darwin 21 skips, 22/25 update; no floor or a 13.0.0 floor would let Darwin 21 through. - Revert the in-app updater.ts guard: it is unreachable on macOS 12. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: Multica Eve <[email protected]> Co-authored-by: multica-agent <[email protected]>
90 lines
3.2 KiB
Docker
90 lines
3.2 KiB
Docker
# --- Dependencies ---
|
|
# Node is pinned to an exact patch so a stale cached `node:22-alpine` layer can
|
|
# never ship a runtime missing a security release. 22.23.4 fixes the
|
|
# 2026-10-21 Node.js security release (CVE-2026-111497, CVE-2026-106069,
|
|
# CVE-2026-105482, ...). Bump all three stages together.
|
|
FROM node:22.23.4-alpine AS deps
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy workspace config and all package.json files for dependency resolution
|
|
COPY pnpm-lock.yaml pnpm-workspace.yaml package.json turbo.json .npmrc ./
|
|
COPY apps/web/package.json apps/web/
|
|
# postinstall runs fumadocs-mdx which reads apps/web/source.config.ts
|
|
COPY apps/web/source.config.ts apps/web/source.config.ts
|
|
# Root pnpm patchedDependencies is read even without the mobile workspace.
|
|
COPY apps/mobile/patches/ apps/mobile/patches/
|
|
COPY packages/core/package.json packages/core/
|
|
COPY packages/ui/package.json packages/ui/
|
|
COPY packages/views/package.json packages/views/
|
|
COPY packages/tsconfig/package.json packages/tsconfig/
|
|
COPY packages/eslint-config/package.json packages/eslint-config/
|
|
|
|
RUN corepack enable && \
|
|
PNPM_VERSION="$(node -p 'require("./package.json").packageManager')" && \
|
|
corepack prepare "$PNPM_VERSION" --activate
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# --- Build ---
|
|
FROM node:22.23.4-alpine AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
# Activate the same pnpm version declared by the repository before the
|
|
# offline frozen install validates package-manager metadata in pnpm-lock.yaml.
|
|
COPY package.json ./
|
|
RUN corepack enable && \
|
|
PNPM_VERSION="$(node -p 'require("./package.json").packageManager')" && \
|
|
corepack prepare "$PNPM_VERSION" --activate
|
|
|
|
# Copy installed dependencies (preserves pnpm symlink structure)
|
|
COPY --from=deps /app ./
|
|
|
|
# Copy source
|
|
COPY package.json turbo.json pnpm-workspace.yaml ./
|
|
COPY apps/web/ apps/web/
|
|
COPY packages/ packages/
|
|
|
|
# Re-link after source overlay (fixes any symlinks overwritten by COPY)
|
|
RUN pnpm install --frozen-lockfile --offline
|
|
|
|
ARG NEXT_PUBLIC_APP_VERSION=dev
|
|
ENV NEXT_PUBLIC_APP_VERSION=$NEXT_PUBLIC_APP_VERSION
|
|
ENV STANDALONE=true
|
|
|
|
# Build the web app (standalone output for minimal runtime)
|
|
RUN pnpm --filter @multica/web build
|
|
|
|
# --- Runtime ---
|
|
FROM node:22.23.4-alpine AS runner
|
|
|
|
WORKDIR /app
|
|
|
|
# Alpine openssl security fixes (CVE-2026-63073, CVE-2026-75803).
|
|
# Floor pins the fix so the build fails instead of silently shipping the CVEs.
|
|
# Remove once the pinned node image includes libssl3 >= 3.5.8-r0.
|
|
RUN apk add --no-cache "libcrypto3>=3.5.8-r0" "libssl3>=3.5.8-r0"
|
|
|
|
ENV NODE_ENV=production
|
|
ENV REMOTE_API_URL=http://backend:8080
|
|
|
|
RUN addgroup --system --gid 1001 nodejs && \
|
|
adduser --system --uid 1001 nextjs
|
|
|
|
# Copy standalone output (includes traced node_modules)
|
|
COPY --from=builder --chown=nextjs:nodejs /app/apps/web/.next/standalone ./
|
|
# Copy static files (not included in standalone)
|
|
COPY --from=builder --chown=nextjs:nodejs /app/apps/web/.next/static ./apps/web/.next/static
|
|
# Copy public assets
|
|
COPY --from=builder --chown=nextjs:nodejs /app/apps/web/public ./apps/web/public
|
|
# Ship the license and attribution notices with the image (LICENSE condition 1b)
|
|
COPY --chown=nextjs:nodejs LICENSE NOTICE ./
|
|
|
|
USER nextjs
|
|
|
|
EXPOSE 3000
|
|
ENV PORT=3000
|
|
ENV HOSTNAME=0.0.0.0
|
|
|
|
CMD ["node", "apps/web/server.js"]
|