Security july 2026

.circleci/config.yml

@@ -69,6 +69,7 @@ workflows:
             only:
               - develop
               - PM-4928
+              - security_july_2026
 
     # Production builds are exectuted only on tagged commits to the
     # master branch.
@@ -77,4 +78,4 @@ workflows:
         filters:
           branches:
             only:
-              - master
+              - master

.dockerignore

@@ -1,6 +1,17 @@
+.git
+.github
+.circleci
 Dockerfile
-deployment/
+.env
+.env.*
+coverage
+deployment
+dist
 docker-compose.yml
-scripts/
-.circleci/
-old_stuff/
+node_modules
+*.log
+legacy_migrate
+old_stuff
+packages/identity-prisma-client
+prisma/member/generated
+scripts

.nvmrc

@@ -1 +1 @@
-22.13.1
+26.5.0

Dockerfile

@@ -1,20 +1,45 @@
-# syntax=docker/dockerfile:1
+# syntax=docker/dockerfile:1.7
 
-FROM node:22.13.1-alpine
+ARG NODE_VERSION=26.5.0
+ARG PNPM_VERSION=11.15.1
 
-RUN apk add --no-cache bash
-RUN apk update
+FROM node:${NODE_VERSION}-alpine AS build
+
+RUN apk upgrade --no-cache \
+    && apk add --no-cache bash
+
+WORKDIR /app
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY prisma ./prisma
+RUN npm install --global pnpm@${PNPM_VERSION}
+RUN pnpm install --frozen-lockfile
+COPY . .
+RUN pnpm run lint
+RUN pnpm run build
+RUN pnpm prune --prod
+RUN node node_modules/prisma/build/index.js generate --schema=prisma/schema.prisma \
+    && node node_modules/prisma/build/index.js generate --schema=prisma/group/schema.prisma \
+    && node node_modules/prisma/build/index.js generate --schema=prisma/member/schema.prisma
+
+FROM node:${NODE_VERSION}-alpine AS runtime
+
+RUN apk upgrade --no-cache \
+    && apk add --no-cache bash \
+    && rm -rf /usr/local/lib/node_modules/npm \
+    && rm -f /usr/local/bin/npm /usr/local/bin/npx
 
 ARG RESET_DB_ARG=false
 ENV RESET_DB=$RESET_DB_ARG
 ARG SEED_DATA_ARG=""
 ENV SEED_DATA=$SEED_DATA_ARG
 ENV PRISMA_CLI_BINARY_TARGETS=linux-musl-openssl-3.0.x
+ENV NODE_ENV=production
 
 WORKDIR /app
-COPY . .
-RUN npm install pnpm -g
-RUN pnpm install
-RUN pnpm run build
+COPY --from=build /app/dist ./dist
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/prisma ./prisma
+COPY --from=build /app/package.json ./package.json
+COPY --from=build /app/appStartUp.sh ./appStartUp.sh
 RUN chmod +x appStartUp.sh
-CMD ./appStartUp.sh
+CMD ["./appStartUp.sh"]

README.md

@@ -18,8 +18,8 @@
 **Prerequisites**
 ---------------
 
-* Node.js (Version 22.13.1 recommended)
-* pnpm (Install globally using npm)
+* Node.js (Version 26.5.0 recommended)
+* pnpm (Version 11.15.1)
 * PostgreSQL Client (`psql`) (Required for importing database dump)
 * Docker (Latest version of Docker Desktop or Docker Engine)
 
@@ -28,16 +28,21 @@
 
 1. Install Node.js and pnpm:
 ```bash
-nvm install 22.13.1
-nvm use 22.13.1
-npm install -g pnpm
+nvm install 26.5.0
+nvm use 26.5.0
+npm install -g pnpm@11.15.1
 ```
 2. Install dependencies:
 ```bash
 pnpm install
 ```
 This command also runs `pnpm run prisma:generate` automatically via the `postinstall` script to generate Prisma clients for both databases.
 
+The production Docker image uses pnpm only in its build stage. At startup, the
+container runs Prisma migrations with the bundled Prisma CLI and then directly
+executes the compiled Node.js application, so npm and pnpm are not required in
+the runtime image.
+
 **Deploying Locally**
 ---------------------
 

appStartUp.sh

@@ -6,11 +6,11 @@ export DATABASE_URL=$(echo -e ${IDENTITY_DB_URL})
 echo "Database - running migrations."
 if $RESET_DB; then
     echo "Resetting DB"
-    npx prisma migrate reset --force
+    node node_modules/prisma/build/index.js migrate reset --force
 else
     echo "Running migrations"
-    npx prisma migrate deploy
+    node node_modules/prisma/build/index.js migrate deploy
 fi
 
 # Start the app
-pnpm start:prod
+exec env NODE_OPTIONS=--openssl-legacy-provider node dist/main

package.json

@@ -10,7 +10,7 @@
     "start:dev": "NODE_OPTIONS=--openssl-legacy-provider nest start --watch",
     "start:debug": "NODE_OPTIONS=--openssl-legacy-provider nest start --debug --watch",
     "start:prod": "NODE_OPTIONS=--openssl-legacy-provider node dist/main",
-    "lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\" --fix --no-error-on-unmatched-pattern",
     "test": "NODE_OPTIONS=--openssl-legacy-provider jest",
     "test:watch": "NODE_OPTIONS=--openssl-legacy-provider jest --watch",
     "test:cov": "NODE_OPTIONS=--openssl-legacy-provider jest --coverage",
@@ -25,14 +25,14 @@
     "prisma:generate:group": "prisma generate --schema=./prisma/group/schema.prisma",
     "prisma:generate:identity": "prisma generate --schema=./prisma/schema.prisma",
     "prisma:generate:member": "prisma generate --schema=./prisma/member/schema.prisma",
-    "prisma:generate": "npm run prisma:generate:identity && npm run prisma:generate:group && npm run prisma:generate:member",
+    "prisma:generate": "pnpm run prisma:generate:identity && pnpm run prisma:generate:group && pnpm run prisma:generate:member",
     "prisma:migrate:identity": "prisma migrate dev --schema=./prisma/schema.prisma",
     "prisma:migrate:group": "prisma migrate dev --schema=./prisma/group/schema.prisma",
     "prisma:migrate:member": "prisma migrate dev --schema=./prisma/member/schema.prisma",
     "prisma:deploy": "prisma migrate deploy  --schema=./prisma/schema.prisma",
     "prisma:pull": "prisma db pull",
     "prisma:studio": "prisma studio --port 5555",
-    "postinstall": "npm run prisma:generate",
+    "postinstall": "pnpm run prisma:generate",
     "db:migrate-to-identity": "npx ts-node scripts/migrate-to-identity.ts",
     "db:load-to-identity": "npx ts-node scripts/load-to-identity.ts",
     "db:backfill-security-user": "npx ts-node scripts/backfill-security-user.ts",
@@ -45,43 +45,40 @@
   "dependencies": {
     "@nestjs/axios": "^4.0.0",
     "@nestjs/cache-manager": "^3.0.1",
-    "@nestjs/common": "^11.1.0",
+    "@nestjs/common": "^11.1.28",
     "@nestjs/config": "^4.0.2",
-    "@nestjs/core": "^11.1.0",
+    "@nestjs/core": "^11.1.28",
     "@nestjs/jwt": "^11.0.0",
     "@nestjs/passport": "^11.0.5",
-    "@nestjs/platform-express": "^11.1.0",
-    "@nestjs/swagger": "^11.2.0",
-    "@prisma/client": "^6.7.0",
+    "@nestjs/platform-express": "^11.1.28",
+    "@nestjs/swagger": "^11.4.6",
+    "@prisma/client": "^6.19.3",
     "@topcoder-platform/topcoder-bus-api-wrapper": "github:topcoder-platform/tc-bus-api-wrapper",
-    "@types/express": "^5.0.1",
-    "@types/uuid": "^10.0.0",
-    "axios": "^1.9.0",
+    "axios": "^1.18.1",
     "bcryptjs": "^3.0.2",
     "cache-manager": "^6.4.3",
     "cache-manager-ioredis": "^2.1.0",
     "class-transformer": "^0.5.1",
-    "class-validator": "^0.14.2",
-    "cors": "^2.8.5",
+    "class-validator": "^0.14.4",
+    "cors": "^2.8.6",
     "csv": "^6.3.11",
     "csv-stringify": "^6.5.2",
     "date-fns": "^4.1.0",
     "date-fns-tz": "^3.2.0",
     "dotenv": "^16.5.0",
     "express": "^5.1.0",
     "ioredis": "^5.6.1",
-    "jsonwebtoken": "^9.0.2",
+    "jsonwebtoken": "^9.0.3",
     "jwks-rsa": "^3.2.0",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.1",
     "passport": "^0.7.0",
     "passport-jwt": "^4.0.1",
-    "prisma": "^6.7.0",
+    "prisma": "^6.19.3",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
     "swagger-ui-express": "^5.0.1",
     "tc-core-library-js": "github:topcoder-platform/tc-core-library-js#master",
-    "trolleyhq": "^1.1.0",
-    "uuid": "^11.1.0",
+    "trolleyhq": "^1.1.0",
     "winston": "^3.17.0"
   },
   "devDependencies": {
@@ -90,13 +87,14 @@
     "@nestjs/cli": "^11.0.7",
     "@nestjs/schematics": "^11.0.5",
     "@nestjs/testing": "^11.1.0",
-    "@swc/cli": "^0.6.0",
-    "@swc/core": "^1.11.24",
+    "@swc/cli": "^0.6.0",
+    "@swc/core": "^1.11.24",
+    "@types/express": "^5.0.1",
     "@types/jest": "^29.5.14",
     "@types/lodash": "^4.17.16",
     "@types/node": "^22.15.14",
     "@types/pg": "^8.15.5",
-    "@types/supertest": "^6.0.3",
+    "@types/supertest": "^6.0.3",
     "eslint": "^9.26.0",
     "eslint-config-prettier": "^10.1.2",
     "eslint-plugin-prettier": "^5.4.0",
@@ -135,5 +133,6 @@
     ],
     "coverageDirectory": "../coverage",
     "testEnvironment": "node"
-  }
-}
+  },
+  "packageManager": "pnpm@11.15.1"
+}

packages/identity-prisma-client/index-browser.js

@@ -21,11 +21,11 @@ exports.Prisma = Prisma
 exports.$Enums = {}
 
 /**
- * Prisma Client JS version: 6.19.1
+ * Prisma Client JS version: 6.19.3
  * Query Engine version: c2990dca591cba766e3b7ef5d9e8a84796e47ab7
  */
 Prisma.prismaVersion = {
-  client: "6.19.1",
+  client: "6.19.3",
   engine: "c2990dca591cba766e3b7ef5d9e8a84796e47ab7"
 }
 

packages/identity-prisma-client/index.d.ts

@@ -609,7 +609,7 @@ export namespace Prisma {
   export import Exact = $Public.Exact
 
   /**
-   * Prisma Client JS version: 6.19.1
+   * Prisma Client JS version: 6.19.3
    * Query Engine version: c2990dca591cba766e3b7ef5d9e8a84796e47ab7
    */
   export type PrismaVersion = {

packages/identity-prisma-client/package.json

@@ -151,7 +151,7 @@
     },
     "./*": "./*"
   },
-  "version": "6.19.1",
+  "version": "6.19.3",
   "sideEffects": false,
   "imports": {
     "#wasm-engine-loader": {

packages/identity-prisma-client/wasm.js

@@ -36,11 +36,11 @@ exports.Prisma = Prisma
 exports.$Enums = {}
 
 /**
- * Prisma Client JS version: 6.19.1
+ * Prisma Client JS version: 6.19.3
  * Query Engine version: c2990dca591cba766e3b7ef5d9e8a84796e47ab7
  */
 Prisma.prismaVersion = {
-  client: "6.19.1",
+  client: "6.19.3",
   engine: "c2990dca591cba766e3b7ef5d9e8a84796e47ab7"
 }
 
@@ -418,7 +418,7 @@ const config = {
     "rootEnvPath": null
   },
   "relativePath": "../../prisma",
-  "clientVersion": "6.19.1",
+  "clientVersion": "6.19.3",
   "engineVersion": "c2990dca591cba766e3b7ef5d9e8a84796e47ab7",
   "datasourceNames": [
     "db"