Replace vulnerable libraries bundled inside npm in the documentation

Dockerfile

@@ -40,6 +40,17 @@ ENV PATH=$PNPM_HOME:$PATH
 
 RUN corepack enable
 
+# The npm shipped in the base image bundles libraries with known vulnerabilities.
+# Replace them with fixed versions from a separately locked installation.
+COPY npm-security /tmp/npm-security
+RUN npm ci --prefix /tmp/npm-security --ignore-scripts --no-audit --no-fund \
+    && for m in balanced-match brace-expansion http-cache-semantics ip-address tar undici; do \
+         rm -rf "/usr/local/lib/node_modules/npm/node_modules/$m" \
+         && cp -a "/tmp/npm-security/node_modules/$m" /usr/local/lib/node_modules/npm/node_modules/; \
+       done \
+    && node /tmp/npm-security/verify.mjs \
+    && rm -rf /tmp/npm-security /root/.npm
+
 COPY --from=deps /repo /repo
 
 WORKDIR /repo/docusaurus

npm-security/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "documentation-npm-security-dependencies",
+  "version": "1.0.0",
+  "private": true,
+  "dependencies": {
+    "brace-expansion": "5.0.12",
+    "http-cache-semantics": "4.3.0",
+    "ip-address": "10.7.4",
+    "tar": "7.5.22",
+    "undici": "6.29.1"
+  }
+}

npm-security/verify.mjs

@@ -0,0 +1,18 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const root = process.argv[2] || '/usr/local/lib/node_modules/npm/node_modules';
+const expected = {
+  'balanced-match': '4.0.4',
+  'brace-expansion': '5.0.12',
+  'http-cache-semantics': '4.3.0',
+  'ip-address': '10.7.4',
+  tar: '7.5.22',
+  undici: '6.29.1',
+};
+
+for (const [name, version] of Object.entries(expected)) {
+  const { version: actual } = JSON.parse(readFileSync(join(root, name, 'package.json'), 'utf8'));
+  if (actual !== version) throw new Error(`${name}@${actual} in npm, expected ${version}`);
+  console.log(`${name}@${actual}`);
+}