Haozhe Wu
1e5b79dac6
React Router 7.12.0 through 8.2.x carry a high-severity RSC-mode CSRF bypass (GHSA-qwww-vcr4-c8h2). We were on 7.18.1, inside that range. The advisory is not reachable here — the app is a client-side SPA on createBrowserRouter with no @react-router/server and no RSC entry point, and the frontend ships as static Vite output — but 7.18.1 is the final 7.x release, no backport exists, and 8.3.0 is the only patched version, so staying put means staying on an EOL line with a permanent open alert. react-router-dom has no 8.x at all; the DOM exports moved into react-router itself. So the dependency is swapped and every import rewritten. All ten APIs in use here are unchanged in 8.3.0, and none of the data-layer surface that changed most between majors is used. react-router 8 requires Node >=22.22.0, which is the same wall that had jsdom 30 and @testing-library/jest-dom 7 sitting in the Dependabot ignore list. Node 20 reached EOL on 2026-04-30, so the toolchain moves to Node 22 across CI, the wiki workflow, the Dockerfile and docker-compose. That unblocks all three at once: jsdom and jest-dom are taken here too, and their ignores are removed rather than left carrying a rationale that no longer holds. Verified on the frontend suite: tsc -b and vite build clean, 310 tests across 35 files pass before and after the jsdom/jest-dom bumps.
83 lines
3.1 KiB
YAML
83 lines
3.1 KiB
YAML
services:
|
|
vibe-trading:
|
|
build: .
|
|
ports:
|
|
- "127.0.0.1:8899:8899"
|
|
env_file:
|
|
- agent/.env
|
|
environment:
|
|
- VIBE_TRADING_TRUST_DOCKER_LOOPBACK=1
|
|
# Ollama runs on the host; from inside the container "localhost" is the
|
|
# container itself, so default to reaching the host via host.docker.internal.
|
|
# Override by exporting OLLAMA_BASE_URL (or setting it in a top-level .env)
|
|
# when Ollama runs elsewhere or on a different port.
|
|
- OLLAMA_BASE_URL=${OLLAMA_BASE_URL:-http://host.docker.internal:11434}
|
|
extra_hosts:
|
|
# Maps host.docker.internal -> host gateway (needed on Linux; harmless on Docker Desktop).
|
|
# Requires Docker Engine >= 20.10 / Compose v2 (host-gateway support).
|
|
- "host.docker.internal:host-gateway"
|
|
volumes:
|
|
- vibe-runs:/app/agent/runs
|
|
- vibe-sessions:/app/agent/sessions
|
|
# User-level agent state: persistent memory, cross-session search index
|
|
# (sessions.db), user-created skills, shadow accounts, hypothesis
|
|
# registry, broker connector config, agent.json. Without this volume a
|
|
# rebuild/recreate wipes it all (#197).
|
|
- vibe-home:/home/vibe/.vibe-trading
|
|
- vibe-swarm-runs:/app/agent/.swarm/runs
|
|
- vibe-uploads:/app/agent/uploads
|
|
# Persist Web-UI-driven agent/.env edits (_write_env_values in
|
|
# src/api/helpers.py writes to /app/agent/.env) across container recreation.
|
|
# env_file above still seeds the initial boot env from the same file.
|
|
- ./agent/.env:/app/agent/.env
|
|
# --- Runtime hardening (VT-007) ---
|
|
cap_drop:
|
|
- ALL
|
|
# SETUID/SETGID are kept on purpose: runner.py drops privilege to the
|
|
# unprivileged vibe-sandbox user for LLM-generated-code subprocesses, which
|
|
# needs setuid/setgid. They are granted from container start (not gained via
|
|
# escalation), so no-new-privileges below does not neutralize them.
|
|
cap_add:
|
|
- SETUID
|
|
- SETGID
|
|
security_opt:
|
|
- "no-new-privileges:true"
|
|
read_only: true
|
|
# Writable scratch on the read-only rootfs. Named volumes above already
|
|
# cover agent/runs, agent/sessions, agent/uploads, agent/.swarm/runs and
|
|
# /home/vibe/.vibe-trading; these tmpfs mounts cover /tmp and the cache dirs
|
|
# matplotlib/fontconfig write to during PDF rendering.
|
|
tmpfs:
|
|
- /tmp
|
|
- /home/vibe/.cache
|
|
- /home/vibe/.config
|
|
# Bound a single runaway backtest. Generous self-hosted defaults; override
|
|
# in a compose override file for constrained hosts.
|
|
mem_limit: 4g
|
|
cpus: 2
|
|
pids_limit: 512
|
|
restart: unless-stopped
|
|
|
|
frontend:
|
|
image: node:22@sha256:5647be709086c696ff32edaaf1c70cd26d1da6ab2b39c32f3c7b4c4a31957e37 # node:22 digest resolved 2026-07-28
|
|
working_dir: /app
|
|
ports:
|
|
- "127.0.0.1:5899:5899"
|
|
volumes:
|
|
- ./frontend:/app
|
|
environment:
|
|
- VITE_API_URL=http://vibe-trading:8899
|
|
command: sh -c "npm install && npm run dev -- --host --port 5899"
|
|
profiles:
|
|
- frontend
|
|
depends_on:
|
|
vibe-trading:
|
|
condition: service_started
|
|
|
|
volumes:
|
|
vibe-runs:
|
|
vibe-sessions:
|
|
vibe-home:
|
|
vibe-swarm-runs:
|
|
vibe-uploads:
|