nodejs-quickstart-structure 1.18.0 → 1.19.0

package/templates/common/.gitattributes

@@ -0,0 +1,46 @@
+# Enforce LF endings for all text files
+* text=auto eol=lf
+
+# Explicitly handle common text file types
+*.js      text eol=lf
+*.ts      text eol=lf
+*.tsx     text eol=lf
+*.jsx     text eol=lf
+*.mjs     text eol=lf
+*.cjs     text eol=lf
+*.json    text eol=lf
+*.md      text eol=lf
+*.sh      text eol=lf
+*.yml     text eol=lf
+*.yaml    text eol=lf
+*.html    text eol=lf
+*.css     text eol=lf
+*.scss    text eol=lf
+*.less    text eol=lf
+*.graphql text eol=lf
+*.sql     text eol=lf
+*.pug     text eol=lf
+
+# Configuration files
+.env*          text eol=lf
+.editorconfig  text eol=lf
+.prettierrc    text eol=lf
+.eslintrc*     text eol=lf
+.gitignore     text eol=lf
+.dockerignore  text eol=lf
+.gitattributes text eol=lf
+
+# Assets
+*.png     binary
+*.jpg     binary
+*.jpeg    binary
+*.gif     binary
+*.ico     binary
+*.webp    binary
+*.avif    binary
+*.pdf     binary
+*.woff    binary
+*.woff2   binary
+*.ttf     binary
+*.eot     binary
+*.svg     text eol=lf

package/templates/common/.snyk.ejs

@@ -0,0 +1,45 @@
+# Snyk (https://snyk.io) policy file, default is to interrupt on any vulnerability found.
+# This file ignores vulnerabilities internal to the package manager (npm) itself,
+# as they do not affect your application's production security posture.
+version: v1.18.2
+ignore:
+  # Minimatch ReDoS/Complexity in npm internal dependencies
+  SNYK-JS-MINIMATCH-15353387:
+    - '*':
+        reason: Internal npm dependency, does not affect application runtime.
+        expires: '2027-03-27T10:00:00.000Z'
+  SNYK-JS-MINIMATCH-15353389:
+    - '*':
+        reason: Internal npm dependency, does not affect application runtime.
+        expires: '2027-03-27T10:00:00.000Z'
+  SNYK-JS-MINIMATCH-15309438:
+    - '*':
+        reason: Internal npm dependency, does not affect application runtime.
+        expires: '2027-03-27T10:00:00.000Z'
+  # Tar Symlink Attack in npm internal dependencies
+  SNYK-JS-TAR-15456201:
+    - '*':
+        reason: Internal npm dependency, does not affect application runtime.
+        expires: '2027-03-27T10:00:00.000Z'
+  SNYK-JS-TAR-15416075:
+    - '*':
+        reason: Internal npm dependency, does not affect application runtime.
+        expires: '2027-03-27T10:00:00.000Z'
+  SNYK-JS-TAR-15307072:
+    - '*':
+        reason: Internal npm dependency, does not affect application runtime.
+        expires: '2027-03-27T10:00:00.000Z'
+  # Brace-expansion Infinite Loop in npm internal dependencies
+  SNYK-JS-BRACEEXPANSION-15789759:
+    - '*':
+        reason: Internal npm dependency, does not affect application runtime.
+        expires: '2027-03-27T10:00:00.000Z'
+  SNYK-JS-ISAACSBRACEEXPANSION-15208653:
+    - '*':
+        reason: Internal npm dependency, does not affect application runtime.
+        expires: '2027-03-27T10:00:00.000Z'
+  # Picomatch ReDoS in npm internal dependencies
+  SNYK-JS-PICOMATCH-15765511:
+    - '*':
+        reason: Internal npm dependency, does not affect application runtime.
+        expires: '2027-03-27T10:00:00.000Z'

package/templates/common/Dockerfile

@@ -1,16 +1,18 @@
 # ==========================================
 # Stage 1: Builder
 # ==========================================
-FROM node:22.22.2-trixie-slim AS builder
+FROM node:22-alpine AS builder
 
 # Upgrade OS packages to fix upstream vulnerabilities (Snyk-detected)
-RUN apt-get update && apt-get upgrade -y && \
-    apt-get install -y --no-install-recommends ca-certificates && \
-    rm -rf /var/lib/apt/lists/*
+RUN apk update && apk upgrade && \
+    apk add --no-cache ca-certificates zlib>=1.3.2-r0 --repository=http://dl-cdn.alpinelinux.org/alpine/edge/main
 
 WORKDIR /app
 ENV NPM_CONFIG_UPDATE_NOTIFIER=false
 
+# Upgrade npm using corepack (safer in Alpine)
+RUN corepack enable && corepack prepare npm@11.6.4 --activate
+
 COPY package*.json ./
 COPY tsconfig*.json ./
 
@@ -25,23 +27,28 @@ COPY . .
 # ==========================================
 # Stage 2: Production
 # ==========================================
-FROM node:22.22.2-trixie-slim AS production
+FROM node:22-alpine AS production
 
 # Upgrade OS packages to fix upstream vulnerabilities (Snyk-detected)
-RUN apt-get update && apt-get upgrade -y && \
-    apt-get install -y --no-install-recommends ca-certificates && \
-    rm -rf /var/lib/apt/lists/*
+RUN apk update && apk upgrade && \
+    apk add --no-cache ca-certificates zlib>=1.3.2-r0 --repository=http://dl-cdn.alpinelinux.org/alpine/edge/main
 
 WORKDIR /app
 
 ENV NODE_ENV=production
 ENV NPM_CONFIG_UPDATE_NOTIFIER=false
 
+# Upgrade npm using corepack (safer in Alpine)
+RUN corepack enable && corepack prepare npm@11.6.4 --activate
+
 COPY package*.json ./
 
 # Install ONLY production dependencies
 RUN npm ci --only=production --ignore-scripts --no-audit --no-fund || npm ci --only=production --ignore-scripts --no-audit --no-fund || npm ci --only=production --ignore-scripts --no-audit --no-fund
 
+# Remove npm and caches to achieve Zero-Vulnerability status in the final image
+RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx /root/.npm /root/.cache
+
 # Copy built artifacts from builder
 <% if (language === 'TypeScript') { %>
 COPY --from=builder /app/dist ./dist
@@ -62,4 +69,5 @@ RUN mkdir -p logs && chown -R node:node logs
 
 USER node
 
-CMD ["npm", "start"]
+# Start application directly with node (safe even without npm)
+CMD ["node", "<% if (language === 'TypeScript') { %>dist/index.js<% } else { %>src/index.js<% } %>"]