Upgrade authlib to 1.7.x and fix critical vulnerabilities

.dockerignore

@@ -1,5 +1,9 @@
 client/.tmp/
+# Avoid copying an empty or stale host bundle into the image; assets come from frontend-builder.
+client/dist/
 node_modules/
+.yarn-cache/
+.yarn/
 viz-lib/node_modules/
 .tmp/
 .venv/

Dockerfile

@@ -4,6 +4,7 @@ RUN npm install --global pnpm@10.30.3
 
 # Controls whether to build the frontend assets
 ARG skip_frontend_build
+ENV SKIP_FRONTEND_BUILD=${skip_frontend_build}
 
 ENV CYPRESS_INSTALL_BINARY=0
 ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=1
@@ -20,24 +21,46 @@ COPY --chown=redash scripts /frontend/scripts
 ARG code_coverage
 ENV BABEL_ENV=${code_coverage:+test}
 
-# Use BuildKit cache mount for pnpm store to speed rebuilds
-RUN --mount=type=cache,id=pnpm-store,target=/frontend/.cache/pnpm,uid=1001,gid=1001 \
-  pnpm config set store-dir /frontend/.cache/pnpm && \
-  if [ "x$skip_frontend_build" = "x" ] ; then pnpm install --frozen-lockfile; fi
+# # Use BuildKit cache mount for pnpm store to speed rebuilds
+# RUN --mount=type=cache,id=pnpm-store,target=/frontend/.cache/pnpm,uid=1001,gid=1001 \
+#   pnpm config set store-dir /frontend/.cache/pnpm && \
+#   if [ "x$skip_frontend_build" = "x" ] ; then pnpm install --frozen-lockfile; fi
+
+# COPY --chown=redash client /frontend/client
+# COPY --chown=redash webpack.config.js /frontend/
+
+# # Use the same cache mount for the build step
+# RUN --mount=type=cache,id=pnpm-store,target=/frontend/.cache/pnpm,uid=1001,gid=1001 <<EOF
+#   if [ "x$skip_frontend_build" = "x" ]; then
+#     pnpm run build
+#   else
+#     mkdir -p /frontend/client/dist
+#     touch /frontend/client/dist/multi_org.html
+#     touch /frontend/client/dist/index.html
+#   fi
+# EOF
+
+# Avoid issues caused by lags in disk and network I/O speeds when working on top of QEMU emulation for multi-platform image building.
+RUN yarn config set network-timeout 300000
+
+RUN if [ -z "${SKIP_FRONTEND_BUILD:-}" ] ; then yarn --frozen-lockfile --network-concurrency 1; fi
 
 COPY --chown=redash client /frontend/client
 COPY --chown=redash webpack.config.js /frontend/
-
-# Use the same cache mount for the build step
-RUN --mount=type=cache,id=pnpm-store,target=/frontend/.cache/pnpm,uid=1001,gid=1001 <<EOF
-  if [ "x$skip_frontend_build" = "x" ]; then
-    pnpm run build
-  else
-    mkdir -p /frontend/client/dist
-    touch /frontend/client/dist/multi_org.html
-    touch /frontend/client/dist/index.html
-  fi
-EOF
+# Use explicit webpack invocation: some environments resolve `webpack` inconsistently after `yarn build:viz`.
+# `set -ex` surfaces the first failing command (clean, viz, or webpack).
+RUN if [ -n "${SKIP_FRONTEND_BUILD:-}" ]; then \
+      mkdir -p /frontend/client/dist \
+      && touch /frontend/client/dist/multi_org.html \
+      && touch /frontend/client/dist/index.html; \
+    else \
+      set -ex; \
+      yarn clean; \
+      yarn build:viz; \
+      NODE_OPTIONS=--openssl-legacy-provider NODE_ENV=production \
+        ./node_modules/.bin/webpack build --config ./webpack.config.js; \
+    fi \
+    && test -f /frontend/client/dist/index.html
 
 FROM python:3.13-slim-bookworm
 
@@ -97,10 +120,14 @@ EOF
 
 WORKDIR /app
 
-ENV POETRY_VERSION=2.1.4
+# Keep aligned with Docker Scout / CVE fixes (path traversal etc. in older installers).
+ENV POETRY_VERSION=2.4.1
 ENV POETRY_HOME=/etc/poetry
 ENV POETRY_VIRTUALENVS_CREATE=false
-RUN curl -sSL --retry 3 --retry-delay 5 https://install.python-poetry.org | python3 -
+
+#RUN curl -sSL --retry 3 --retry-delay 5 https://install.python-poetry.org | python3 -
+RUN python3 -m pip install --no-cache-dir --upgrade "pip>=26.1" "setuptools>=78.1.1" "wheel>=0.46.2" \
+  && curl -sSL https://install.python-poetry.org | python3 -
 
 # Avoid crashes, including corrupted cache artifacts, when building multi-platform images with GitHub Actions.
 RUN /etc/poetry/bin/poetry cache clear pypi --all
@@ -110,7 +137,9 @@ COPY pyproject.toml poetry.lock ./
 ARG POETRY_OPTIONS="--no-root --no-interaction --no-ansi"
 # for LDAP authentication, install with `ldap3` group
 # disabled by default due to GPL license conflict
-ARG install_groups="main,all_ds,dev"
+# Default omits `dev` so production images exclude pytest/virtualenv/etc. (smaller SBOM, fewer CVEs).
+# Local compose and CI pass: --build-arg install_groups=main,all_ds,dev
+ARG install_groups="main,all_ds"
 RUN /etc/poetry/bin/poetry install --only $install_groups $POETRY_OPTIONS
 
 COPY --chown=redash . /app

client/.babelrc

@@ -12,14 +12,8 @@
     "@babel/preset-typescript"
   ],
   "plugins": [
-    "@babel/plugin-transform-class-properties",
-    "@babel/plugin-transform-object-assign",
-    [
-      "babel-plugin-transform-builtin-extend",
-      {
-        "globals": ["Error"]
-      }
-    ]
+    "@babel/plugin-proposal-class-properties",
+    "@babel/plugin-transform-object-assign"
   ],
   "env": {
     "test": {

compose.yaml

@@ -7,6 +7,7 @@ x-redash-service: &redash-service
       skip_frontend_build: "true"  # set to empty string to build
   volumes:
     - .:/app
+    # - /app/client/dist
   env_file:
     - .env
 x-redash-environment: &redash-environment
@@ -29,7 +30,7 @@ services:
       - postgres
       - redis
     ports:
-      - "5001:5000"
+      - "5000:5000"
       - "5678:5678"
     environment:
       <<: *redash-environment

package.json

@@ -16,6 +16,17 @@
     "analyze:build": "pnpm run clean && NODE_ENV=production BUNDLE_ANALYZER=on webpack",
     "lint": "pnpm run lint:base --ext .js --ext .jsx --ext .ts --ext .tsx ./client",
     "lint:fix": "pnpm run lint:base  --fix --ext .js --ext .jsx --ext .ts --ext .tsx ./client",
+
+    "_clean": "node ./scripts/client-dist.js clean",
+    "_build:viz": "(cd viz-lib && yarn build:babel)",
+    "_build": "node ./scripts/client-dist.js check && yarn clean && yarn build:viz && NODE_OPTIONS=--openssl-legacy-provider NODE_ENV=production webpack build",
+    "_watch:app": "NODE_OPTIONS=--openssl-legacy-provider webpack watch --progress",
+    "_watch:viz": "(cd viz-lib && yarn watch:babel)",
+    "_analyze": "yarn clean && BUNDLE_ANALYZER=on NODE_OPTIONS=--openssl-legacy-provider webpack build",
+    "_analyze:build": "yarn clean && NODE_ENV=production BUNDLE_ANALYZER=on NODE_OPTIONS=--openssl-legacy-provider webpack build",
+    "_lint": "yarn lint:base --ext .js --ext .jsx --ext .ts --ext .tsx ./client",
+    "_lint:fix": "yarn lint:base  --fix --ext .js --ext .jsx --ext .ts --ext .tsx ./client",
+
     "lint:base": "eslint --config ./client/.eslintrc.js --ignore-path ./client/.eslintignore",
     "lint:ci": "pnpm run lint --max-warnings 0 --format junit --output-file /tmp/test-results/eslint/results.xml",
     "prettier": "prettier --write 'client/app/**/*.{js,jsx,ts,tsx}' 'client/cypress/**/*.{js,jsx,ts,tsx}'",
@@ -126,6 +137,7 @@
     "eslint-plugin-react-hooks": "^4.6.2",
     "eslint-webpack-plugin": "^4.2.0",
     "html-webpack-plugin": "^5.6.6",
+
     "identity-obj-proxy": "^3.0.0",
     "jest": "^30.2.0",
     "jest-environment-jsdom": "^30.2.0",
@@ -184,6 +196,11 @@
     "fs": false,
     "path": false
   },
+  "resolutions": {
+    "execa": "^5.1.1",
+    "form-data": "^4.0.5",
+    "basic-ftp": "^5.2.0"
+  },
   "//": "browserslist set to 'Async functions' compatibility",
   "browserslist": [
     "Edge >= 15",