Merge pull request #56 from weaponsforge/fix/weaponsforge-55

fix: vitest package security cve-2025-24964

Author: weaponsforge

Dockerfile

@@ -1,8 +1,11 @@
 FROM node:20.15.0-alpine AS base
 RUN mkdir -p /opt/app
 WORKDIR /opt/app
-RUN addgroup -S user && adduser -S user -G user
-RUN chown -R user:user /opt/app
+# RUN addgroup -S user && adduser -S user -G user
+# RUN chown -R user:user /opt/app
+
+# Use the image's default user
+RUN chown -R node:node /opt/app
 COPY package*.json ./
 
 # BUILD TARGET
@@ -16,8 +19,8 @@ FROM base AS development
 RUN npm install
 COPY . ./
 RUN mkdir /opt/app/node_modules/.vite \
-  && chown -R user:user /opt/app/node_modules/.vite
-USER user
+  && chown -R node:node /opt/app/node_modules/.vite
+USER node
 EXPOSE 9229
 CMD ["sh"]
 

README.md

@@ -41,6 +41,7 @@ This repository contains solutions and a local development environment for the [
 - [Usage](#-usage)
 - [Alternate Usage](#-alternate-usage)
 - [Available Scripts](#-available-scripts)
+- [Docker Scripts](#-docker-scripts)
 
 </details>
 
@@ -129,33 +130,33 @@ Using Node
 
 Using Docker
 
-- Build the image
+- **Build the image**
    ```
    docker compose -f docker-compose.dev.yml build
    ```
 
-- Transpile the TypeScript files to JavaScript (PowerShell)
+- **Transpile the TypeScript files to JavaScript** (PowerShell)
    ```
    docker run -it -v ${pwd}:/opt/app -v /opt/app/node_modules --rm weaponsforge/adventofcode:dev npm run transpile
    ```
 
-- Run tests (PowerShell)
+- **Run tests** (PowerShell)
    ```
    docker run -it -v ${pwd}:/opt/app -v /opt/app/node_modules --rm weaponsforge/adventofcode:dev npm test
    ```
 
-- Watch TS file updates: Use available scripts - `npm run watch`, `npm run watch:docker:win`
+- **Watch TS file updates: Use available scripts** - e.g., `npm run watch`, `npm run docker:watch:win`
    ```
    docker run -it -v ${pwd}:/opt/app -v /opt/app/node_modules --rm weaponsforge/adventofcode:dev <AVAILABLE_SCRIPT>
    ```
 
-- Run a script and debug it with the VSCode Debugger.
+- **Run a script and debug it with the VSCode Debugger**
    - Prepare a function for debugging with VSCode in Docker. Wrap it in the `AOCRunScript()` function.
-   - Assign the path to a TypeScript file from the previous step to the package.json file's `"dev:debug:docker"` script, replacing `src/sample/sample.ts`.
-      - `"dev:debug:docker": "export IS_DOCKER=true && node --inspect=0.0.0.0:9229 ./node_modules/.bin/vite-node src/path/to/script.ts"`
+   - Assign the path to a TypeScript file from the previous step to the package.json file's `"docker:debug"` script, replacing `src/sample/sample.ts`.
+      - `"docker:debug": "export IS_DOCKER=true && node --inspect=0.0.0.0:9229 ./node_modules/.bin/vite-node src/path/to/script.ts"`
    - Run the script with VSCode debugging:
       ```
-      docker run -it -v ${pwd}:/opt/app -v /opt/app/node_modules --rm weaponsforge/adventofcode:dev npm run dev:debug:docker
+      docker run -it -v ${pwd}:/opt/app -v /opt/app/node_modules -p 9229:9229 --rm weaponsforge/adventofcode:dev npm run docker:debug
       ```
    > **INFO:** This process requires attaching a debugger with the VSCode launch config defined in Issue [#53](https://github.com/weaponsforge/adventofcode/issues/53)
 
@@ -185,6 +186,8 @@ Using Docker
 
 ## 📜 Available Scripts
 
+These scripts, compatible with running in Node and Docker, run various TypeScript scripts and tests.
+
 <details>
 <summary>Click to expand the list of available scripts</summary>
 
@@ -196,33 +199,54 @@ Runs `vitest` in watch mode, watching file changes and errors to files linked wi
 
 Watches file changes in `.ts` files using the `tsc --watch` option.
 
-### `npm run watch:docker:win`
-
-Watches file changes in `.ts` files using the `tsc --watch` option with `dynamicPriorityPolling` in Docker containers running in Windows WSL2.
-
 ### `npm run dev:debug`
 
 Runs the sample TS script.
 
 ### `npm run transpile`
 
-Builds the JavaScript files from the TypeScript files.
+Builds JavaScript, `.d.ts` declaration files, and map files from the TypeScript source files.
 
 ### `npm run transpile:noemit`
 
-Runs type-checking without generating the JavaScript or declatation files from the TypeScript files.
+Runs type-checking without generating the JavaScript or declaration files from the TypeScript files.
 
 ### `npm run lint`
 
 Lints TypeScript source codes.
 
 ### `npm run lint:fix`
 
-Fixes TypeScript lint errors.
+Fixes lint errors in TypeScript files.
 
 ### `npm test`
 
-Runs tests defined in `*.test.ts` files.
+Runs test scripts defined in `*.test.ts` files.
+
+</details>
+
+## 📦 Docker Scripts
+
+These scripts allow optional Docker-related processes, such as enabling file watching in Docker containers running in Windows WSL2 and others.
+
+<details>
+<summary>Click to expand the list of available scripts</summary>
+
+### `npm run docker:debug`
+
+- Runs the `"/src/sample/sample.ts"` script in containers with debugging enabled in VSCode.
+- Replace the `"/src/sample/sample.ts"` file path in the package.json file's `"docker:debug"` script with a target TypeScript file for debugging.
+- Map port **9229** to enable debugging VSCode while running in Docker.<br>
+`docker:debug": "export IS_DOCKER=true && node --inspect=0.0.0.0:9229 ./node_modules/.bin/vite-node src/path/to/<NEW_SCRIPT>.ts`
+
+### `npm run docker:watch:win`
+
+Watches file changes in `.ts` files using the `tsc --watch` option with `dynamicPriorityPolling` in Docker containers running in Windows WSL2.
+
+### `npm run docker:dev:win`
+
+- Sets and exports the environment variables: `CHOKIDAR_USEPOLLING=1` and `CHOKIDAR_INTERVAL=1000`
+- Runs `vitest` in watch mode inside Docker containers running in Windows WSL2, watching file changes and errors to files linked with `*.test.ts` files.
 
 </details>
 <br>