npx skills add ...
npx skills add firebase/firebase-tools --skill resolve-docker-vulnerabilities
npx skills add firebase/firebase-tools --skill resolve-docker-vulnerabilities
Skill to resolve Docker vulnerabilities for the firebase-cli image. Use this skill when you need to check for vulnerabilities in the firebase-cli Docker image and address them.
This skill guides you through the process of listing images, checking for vulnerabilities, planning remediation, and verifying the fixes by publishing to a staging repository.
Run the build on fir-tools-builds and publish to the staging repository in firebase-cli to see the baseline vulnerabilities after the build's own updates.
Check the vulnerability reports for the image just pushed to staging. You will need to find the digest of the image first.
Then check vulnerabilities using the digest:
To investigate which layers and file paths are causing the vulnerabilities, run the command with --format=json:
Look for fileLocation and layerDetails in the output to understand if the vulnerability is in:
/usr/local/node_packages/node_modules). Recommend updating the package.json and running the build again. You can use overrides as needed here to upgrade transitive dependencies to non-breaking versions./usr/local/lib/node_modules/npm). Recommend waiting for upstream fixes (which will be pulled in as soon as they are available)./root/.cache/firebase/emulators). Recommend raising these issues to the team owning the emulator.For each vulnerable package identified:
Present the proposed plan to the user for approval before making changes.
After making changes to the Dockerfile or related files, repeat Step 1 and Step 2 to publish a new staged image and verify that the vulnerabilities have been resolved.
gcloud artifacts vulnerabilities list us-docker.pkg.dev/firebase-cli/staging/firebase@sha256:<DIGEST> --format=json