[CI] Pin Docker pnpm to 10.34.5
ClosedPublic
Actions

Authored by bytesofman on Sep 8 2026, 18:37.

Project Tags

None

Referenced Files

None

Subscribers

None

Details

Reviewers

Fabien

Group Reviewers

Restricted Project

Commits

rABCce3a9138421b: [CI] Pin Docker pnpm to 10.34.5

Summary

Docker images installed unpinned latest pnpm, which is now 12 and rejects pnpm fetch --frozen-lockfile. Pin to 10.34.5 (latest 10.x, includes GHSA-vq4v-j7r6-jq4m).

Test Plan

After land, CashtabappCom and ecash-herald Docker builds succeed past the fetch step

Diff Detail

Repository

rABC Bitcoin ABC

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

bytesofman created this revision.Sep 8 2026, 18:37

bytesofman held this revision as a draft.

Build Bitcoin ABC Diffs / Diff Testing (ai-review) passed.
CodeRabbit Review

Diff : committed changes only
Compare : HEAD → master
Directory : work
────────────────────────────────────────

(\(\
(• .•) Name's Rabbit. CodeRabbit. Licensed to review.

────────────────────────────────────────
Review complete
No findings ✔

11 files reviewed:

apps/marlin-wallet/web/install-dependencies.sh
cashtab-faucet.Dockerfile
cashtab.Dockerfile
cashtab/install-deps.sh
charts.e.cash.Dockerfile
ecash-herald.Dockerfile
faucet.Dockerfile
marlin-wallet.Dockerfile
metachronik.Dockerfile
notifications-server.Dockerfile

... and 1 more file
────────────────────────────────────────

Keep fetch --frozen-lockfile; pin Docker pnpm to 10.24.0 only.

bytesofman retitled this revision from [CI] Pin Docker pnpm and drop fetch --frozen-lockfile to [CI] Pin Docker pnpm to 10.24.0.Sep 8 2026, 18:44

bytesofman edited the summary of this revision. (Show Details)

bytesofman edited the test plan for this revision. (Show Details)

Harbormaster completed remote builds in B38111: Diff 61258.Sep 8 2026, 18:44

bytesofman published this revision for review.Sep 8 2026, 18:47

Fabien accepted this revision.Sep 8 2026, 18:48

This revision is now accepted and ready to land.Sep 8 2026, 18:48

Harbormaster completed remote builds in B38112: Diff 61259.Sep 8 2026, 18:50

Build Bitcoin ABC Diffs / Diff Testing (ai-review) passed.
CodeRabbit Review

Diff : committed changes only
Compare : HEAD → master
Directory : work
────────────────────────────────────────

(\(\
(• .•) Codicem Purgo, Ergo Sum. I debug, therefore I am.

────────────────────────────────────────────────────────────────────────

major [Security & Privacy]
→ ]8;;vscode://file//work/cashtab-faucet.Dockerfile:62cashtab-faucet.Dockerfile:62]8;;

Upgrade pnpm to a patched 10.x release.

pnpm@10.24.0 is affected by GHSA-vq4v-j7r6-jq4m. A malicious package
can write outside node_modules during pnpm install. Pin at least
pnpm@10.34.5 in this Dockerfile.

────────────────────────────────────────
Review complete
1 finding ✔

Major 1

9 files reviewed: