From bed7278e78b2e57612609871fb339af128f3d243 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Sat, 29 Aug 2026 19:20:59 +0200 Subject: [PATCH] Pin the Prisma CLI install to exact versions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The /opt/prisma-cli npm install named prisma@7.8 and @prisma/engines@7.8 while its neighbours (tsx, dotenv) were exact — the one unpinned spot the Scorecard pinned-dependencies probe flagged. Both ranges resolve to 7.8.0 today, so the exact pin changes nothing in the built image; it only stops a future 7.8.x from arriving unreviewed. Resolves Scorecard alert 63. --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 0de6f3ccb..42284699a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -184,7 +184,7 @@ RUN mkdir -p /opt/prisma-cli && \ cd /opt/prisma-cli && \ npm init -y && \ npm pkg set 'overrides.deepmerge-ts=^8.0.0' && \ - npm install --omit=dev prisma@7.8 @prisma/engines@7.8 tsx@4.23.1 dotenv@17.4.2 && \ + npm install --omit=dev prisma@7.8.0 @prisma/engines@7.8.0 tsx@4.23.1 dotenv@17.4.2 && \ ln -sfn /opt/prisma-cli/node_modules/.bin/tsx /usr/local/bin/healthlog-tsx && \ ln -sfn /opt/prisma-cli/node_modules/dotenv /app/node_modules/dotenv && \ ln -sfn /opt/prisma-cli/node_modules/prisma /app/node_modules/prisma && \