jethac opened a new issue, #42979: URL: https://github.com/apache/superset/issues/42979
### Bug description `docker/docker-frontend.sh` line 36 runs a bare `npm install`, which ignores `package-lock.json` and resolves fresh versions at build time: ```sh echo "Running \"npm install\"" npm install ``` A dev-image build can therefore pull a package version published moments earlier, including one published after the lockfile was last reviewed. That discards the lockfile, which is currently the repository's main protection against a compromised npm release — and the repository has no `.npmrc`, so there is no install-time cooldown backing it up either. ### Expected results The dev frontend image builds against the versions in the committed lockfile, reproducibly. ### Actual results Versions are re-resolved at build time and may not match the lockfile. ### Proposed fix Use `npm ci`. If a lockfile-less install is genuinely required at that point in the build, a comment saying why would help, because it otherwise reads as an oversight. Verified against `master` at `3539c41dab`. Happy to open a PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
