diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e1b854f3..f5e52ed9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -68,3 +68,11 @@ updates: timezone: Europe/London commit-message: prefix: 'chore (deps): ' + + - package-ecosystem: docker + directory: / + schedule: + interval: 'weekly' + day: 'friday' + time: '03:00' + timezone: Europe/London diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index 59f3d2cd..da4d6caa 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -16,10 +16,10 @@ jobs: pages: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set node version - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 registry-url: "https://registry.npmjs.org" @@ -56,7 +56,7 @@ jobs: - name: Deploy to GitHub Pages if: success() && github.ref == 'refs/heads/master' - uses: crazy-max/ghaction-github-pages@v5 + uses: crazy-max/ghaction-github-pages@1d6ee9b181a81033a16bd707a1401afa978daab4 # v5.0.0 with: target_branch: gh-pages build_dir: ./build/prod diff --git a/.github/workflows/pull_requests.yml b/.github/workflows/pull_requests.yml index 71129375..d8b80871 100644 --- a/.github/workflows/pull_requests.yml +++ b/.github/workflows/pull_requests.yml @@ -12,10 +12,10 @@ jobs: main: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set node version - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 registry-url: "https://registry.npmjs.org" @@ -39,7 +39,7 @@ jobs: - name: Upload Build Artefact if: success() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: zipped-build path: build/prod/*.zip @@ -53,14 +53,14 @@ jobs: - name: Set up Docker Buildx if: success() - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 - name: Production Image Build if: success() id: build-image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 with: - platforms: linux/amd64,linux/arm64 + platforms: linux/amd64,linux/arm64,linux/arm/v7 diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml index f0d98f9c..ab9cf670 100644 --- a/.github/workflows/releases.yml +++ b/.github/workflows/releases.yml @@ -22,10 +22,10 @@ jobs: contents: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set node version - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 registry-url: "https://registry.npmjs.org" @@ -52,14 +52,14 @@ jobs: xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 - name: Image Metadata id: image-metadata - uses: docker/metadata-action@v6 + uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | @@ -68,24 +68,24 @@ jobs: type=semver,pattern={{version}} - name: Log in to GHCR - uses: docker/login-action@v4 + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 with: registry: ${{ env.REGISTRY }} username: ${{ env.REGISTRY_USER }} password: ${{ env.REGISTRY_PASSWORD }} - name: Publish to GHCR - uses: docker/build-push-action@v6 + uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 with: context: . push: true tags: ${{ steps.image-metadata.outputs.tags }} labels: ${{ steps.image-metadata.outputs.labels }} - platforms: linux/amd64,linux/arm64 + platforms: linux/amd64,linux/arm64,linux/arm/v7 - name: Upload Release Assets id: upload-release-assets - uses: svenstaro/upload-release-action@v2 + uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # v2 with: repo_token: ${{ secrets.GITHUB_TOKEN }} file: build/prod/*.zip @@ -101,10 +101,10 @@ jobs: needs: main runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set node version - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 registry-url: "https://registry.npmjs.org" diff --git a/Dockerfile b/Dockerfile index feb130ba..c8d40424 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ # Modifier --platform=$BUILDPLATFORM limits the platform to "BUILDPLATFORM" during buildx multi-platform builds # This is because npm "chromedriver" package is not compatiable with all platforms # For more info see: https://docs.docker.com/build/building/multi-platform/#cross-compilation -FROM --platform=$BUILDPLATFORM node:24-alpine AS builder +FROM --platform=$BUILDPLATFORM node:24-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS builder WORKDIR /app @@ -27,7 +27,7 @@ RUN npm run build ######################################### # Package static build files into nginx # ######################################### -FROM nginxinc/nginx-unprivileged:stable-alpine AS cyberchef +FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:808f7846d21a9c94cf53833e8807a00a33fd0b65cc47fb05b79efe366c2d201f AS cyberchef LABEL maintainer="GCHQ " diff --git a/package-lock.json b/package-lock.json index a78a2a26..ea1a82bf 100644 --- a/package-lock.json +++ b/package-lock.json @@ -39,7 +39,7 @@ "d3": "7.9.0", "d3-hexbin": "^0.2.2", "diff": "^5.2.2", - "dompurify": "^3.4.2", + "dompurify": "^3.4.3", "es6-promisify": "^7.0.0", "escodegen": "^2.1.0", "esprima": "^4.0.1", @@ -85,7 +85,7 @@ "path": "^0.12.7", "popper.js": "^1.16.1", "process": "^0.11.10", - "protobufjs": "^7.5.6", + "protobufjs": "^7.5.8", "punycode.js": "^2.3.1", "qr-image": "^3.2.0", "reflect-metadata": "^0.2.2", @@ -94,7 +94,7 @@ "snackbarjs": "^1.1.0", "sortablejs": "^1.15.7", "split.js": "^1.6.5", - "sql-formatter": "^15.7.3", + "sql-formatter": "^15.7.4", "ssdeep.js": "0.0.3", "stream-browserify": "^3.0.0", "tesseract.js": "^6.0.1", @@ -118,7 +118,7 @@ "@codemirror/language": "^6.12.3", "@codemirror/search": "^6.7.0", "@codemirror/state": "^6.5.4", - "@codemirror/view": "^6.41.1", + "@codemirror/view": "^6.43.0", "autoprefixer": "^10.5.0", "babel-loader": "^10.1.1", "base64-loader": "^1.0.0", @@ -132,7 +132,7 @@ "css-loader": "^7.1.4", "eslint": "^9.39.4", "eslint-plugin-jsdoc": "^50.8.0", - "globals": "^17.4.0", + "globals": "^17.6.0", "grunt": "^1.6.2", "grunt-chmod": "~1.1.1", "grunt-concurrent": "^3.0.0", @@ -1897,9 +1897,9 @@ } }, "node_modules/@codemirror/view": { - "version": "6.41.1", - "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.41.1.tgz", - "integrity": "sha512-ToDnWKbBnke+ZLrP6vgTTDScGi5H37YYuZGniQaBzxMVdtCxMrslsmtnOvbPZk4RX9bvkQqnWR/WS/35tJA0qg==", + "version": "6.43.0", + "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.0.tgz", + "integrity": "sha512-V7ZCLQO3Jus9hzh2jVCCPW3mO4IBMr43O37PqSUYautJSnnJF41YlgLw21x0fLJTYvJ+Vkm6Gp+qKGH9pltgXA==", "dev": true, "license": "MIT", "dependencies": { @@ -8641,9 +8641,9 @@ } }, "node_modules/dompurify": { - "version": "3.4.2", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.2.tgz", - "integrity": "sha512-lHeS9SA/IKeIFFyYciHBr2n0v1VMPlSj843HdLOwjb2OxNwdq9Xykxqhk+FE42MzAdHvInbAolSE4mhahPpjXA==", + "version": "3.4.3", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.3.tgz", + "integrity": "sha512-VVwJidIJcp1hpg2OMXML3ZVRPYSZiq4aX7qBh83BSIpOaRDqI+qxhXjjIWnpzkOXhmp0L81lnoME1mnCc9H48A==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" @@ -10355,9 +10355,9 @@ } }, "node_modules/globals": { - "version": "17.5.0", - "resolved": "https://registry.npmjs.org/globals/-/globals-17.5.0.tgz", - "integrity": "sha512-qoV+HK2yFl/366t2/Cb3+xxPUo5BuMynomoDmiaZBIdbs+0pYbjfZU+twLhGKp4uCZ/+NbtpVepH5bGCxRyy2g==", + "version": "17.6.0", + "resolved": "https://registry.npmjs.org/globals/-/globals-17.6.0.tgz", + "integrity": "sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA==", "dev": true, "license": "MIT", "engines": { @@ -15141,9 +15141,9 @@ "license": "MIT" }, "node_modules/protobufjs": { - "version": "7.5.6", - "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.6.tgz", - "integrity": "sha512-M71sTMB146U3u0di3yup8iM+zv8yPRNQVr1KK4tyBitl3qFvEGucq/rGDRShD2rsJhtN02RJaJ7j5X5hmy8SJg==", + "version": "7.5.8", + "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.8.tgz", + "integrity": "sha512-dvpCIeLPbXZS/Ete7yLaO7RenOdken2NHKykBXbsaGxZT0UTltcarBciw+A78SRQs9iMAAVpsYA+l8b1hTePIA==", "hasInstallScript": true, "license": "BSD-3-Clause", "dependencies": { @@ -16771,9 +16771,9 @@ "license": "BSD-3-Clause" }, "node_modules/sql-formatter": { - "version": "15.7.3", - "resolved": "https://registry.npmjs.org/sql-formatter/-/sql-formatter-15.7.3.tgz", - "integrity": "sha512-5+zl9Nqg5aNjss0tb1G+StpC4dJKbjv3+g8CL/+V+00PfZop+2RKGyi53ScFl0dr+Dkx1LjmUO54Q3N7K3EtMw==", + "version": "15.7.4", + "resolved": "https://registry.npmjs.org/sql-formatter/-/sql-formatter-15.7.4.tgz", + "integrity": "sha512-87VsXfl9ng7oNZlV0p3c/DfraFneH4EPYZ1F7v+ZbGTdddtI0FHcqRRshJx6/Sy7saXOiCwstw0J2cP4Z6Xj5A==", "license": "MIT", "dependencies": { "argparse": "^2.0.1", diff --git a/package.json b/package.json index 86e0e7d4..e923a5b9 100644 --- a/package.json +++ b/package.json @@ -48,7 +48,7 @@ "@codemirror/language": "^6.12.3", "@codemirror/search": "^6.7.0", "@codemirror/state": "^6.5.4", - "@codemirror/view": "^6.41.1", + "@codemirror/view": "^6.43.0", "autoprefixer": "^10.5.0", "babel-loader": "^10.1.1", "base64-loader": "^1.0.0", @@ -62,7 +62,7 @@ "css-loader": "^7.1.4", "eslint": "^9.39.4", "eslint-plugin-jsdoc": "^50.8.0", - "globals": "^17.4.0", + "globals": "^17.6.0", "grunt": "^1.6.2", "grunt-chmod": "~1.1.1", "grunt-concurrent": "^3.0.0", @@ -122,7 +122,7 @@ "d3": "7.9.0", "d3-hexbin": "^0.2.2", "diff": "^5.2.2", - "dompurify": "^3.4.2", + "dompurify": "^3.4.3", "es6-promisify": "^7.0.0", "escodegen": "^2.1.0", "esprima": "^4.0.1", @@ -168,7 +168,7 @@ "path": "^0.12.7", "popper.js": "^1.16.1", "process": "^0.11.10", - "protobufjs": "^7.5.6", + "protobufjs": "^7.5.8", "punycode.js": "^2.3.1", "qr-image": "^3.2.0", "reflect-metadata": "^0.2.2", @@ -177,7 +177,7 @@ "snackbarjs": "^1.1.0", "sortablejs": "^1.15.7", "split.js": "^1.6.5", - "sql-formatter": "^15.7.3", + "sql-formatter": "^15.7.4", "ssdeep.js": "0.0.3", "stream-browserify": "^3.0.0", "tesseract.js": "^6.0.1",