[bestickley]

Summary

• Container images: the generated Global/Regional Containers Dockerfiles build on node:24-alpine but never upgrade OS packages. The current upstream image (Alpine 3.24.2) still ships zlib-1.3.2-r0 (CVE-2026-85091), while 1.3.2-r1 is already in the Alpine repo. Both Dockerfiles now run apk upgrade --no-cache before apk add, so images pick up security fixes released after the base image was published. User Dockerfiles carrying the generated header are rewritten automatically.
• Dependabot: adds a handlebars: ^4.7.10 pnpm override (via .projenrc.ts) to resolve alerts #436, #437, #438. handlebars is transitive (ts-jest, conventional-changelog-writer); the lockfile diff touches only handlebars.

Testing

• docker run node:24-alpine sh -c 'apk upgrade --no-cache && apk add --no-cache libc6-compat && apk info -v | grep ^zlib' → zlib-1.3.2-r1, node v24.22.0.
• pnpm compile, pnpm projen, pnpm jest src/nextjs-build/nextjs-build.test.ts (52 passed).

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/handlebars	4.7.10	🟢 5.1	Details Check Score Reason Code-Review 🟢 8 Found 14/17 approved changesets -- score normalized to 8 Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Maintained 🟢 3 0 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• pnpm-lock.yaml

[bestickley]

Code review (/code-review high)

9 findings, most severe first. Fixes are in 9fd7e2b.

#	Finding	Outcome
1–2	apk upgrade only runs when the image is rebuilt. The DockerImageAsset hash covers the build context, so a redeploy with an unchanged app reuses the image already in ECR. On a local machine, the cached RUN layer is reused as well.	Documented, not changed. The Dockerfile comment now says the upgrade takes effect only when CDK rebuilds the image, and the README says so too. Busting the cache on every deploy would rebuild every image on every deploy, which is too costly for this patch.
3	Users who own their Dockerfile don't get the fix.	Fixed: the README tells them to add RUN apk upgrade --no-cache.
4	Dockerfiles edited under the header get overwritten on upgrade, with a .bak copy.	No change. This is the documented header contract, and it's how the fix reaches users.
5	apk upgrade && apk add fetches APKINDEX twice.	No change. It costs a second or two per build.
6	The upgrade comment split the libc6-compat note from its RUN.	Fixed: apk upgrade now has its own RUN line and comment.
7	The handlebars override had no major-version scope.	Fixed: it is now handlebars@4, matching js-yaml@3 and brace-expansion@5.
8	copyDockerfileToContext / isGeneratedDockerfile have no tests.	Out of scope: this is pre-existing.
9	The two Dockerfiles duplicate their shared lines.	Out of scope: this is pre-existing.

Verified: on node:24-alpine, apk upgrade --no-cache then apk add --no-cache libc6-compat gives zlib-1.3.2-r1. pnpm projen regenerates the lockfile with only handlebars 4.7.9 → 4.7.10.