diff --git a/claude/Dockerfile b/claude/Dockerfile index 07a3560..0de1d47 100644 --- a/claude/Dockerfile +++ b/claude/Dockerfile @@ -31,28 +31,28 @@ RUN curl -fsSL https://claude.ai/install.sh | bash -s stable # Install MCP servers globally — entry points land in /usr/local/lib/node_modules/ -RUN npm install -g \ - @modelcontextprotocol/server-github \ - @yoda.digital/gitlab-mcp-server \ - @aashari/mcp-server-atlassian-jira \ - @aashari/mcp-server-atlassian-confluence - -# Patch transitive CVEs bundled inside MCP server node_modules: -# CVE-2025-66414, CVE-2026-0621 — @modelcontextprotocol/sdk <1.25.2 -# CVE-2026-33671 — picomatch <4.0.4 -RUN for pkg_dir in \ - /usr/local/lib/node_modules/@modelcontextprotocol/server-github \ - /usr/local/lib/node_modules/@yoda.digital/gitlab-mcp-server \ - /usr/local/lib/node_modules/@aashari/mcp-server-atlassian-jira \ - /usr/local/lib/node_modules/@aashari/mcp-server-atlassian-confluence; do \ - [ -d "$pkg_dir" ] && \ - cd "$pkg_dir" && \ - npm install --no-audit --no-fund \ - @modelcontextprotocol/sdk@1.25.2 \ - picomatch@4.0.4 \ - || true; \ - done - +# RUN npm install -g \ +# @modelcontextprotocol/server-github \ +# @yoda.digital/gitlab-mcp-server \ +# @aashari/mcp-server-atlassian-jira \ +# @aashari/mcp-server-atlassian-confluence +# +# # Patch transitive CVEs bundled inside MCP server node_modules: +# # CVE-2025-66414, CVE-2026-0621 — @modelcontextprotocol/sdk <1.25.2 +# # CVE-2026-33671 — picomatch <4.0.4 +# RUN for pkg_dir in \ +# /usr/local/lib/node_modules/@modelcontextprotocol/server-github \ +# /usr/local/lib/node_modules/@yoda.digital/gitlab-mcp-server \ +# /usr/local/lib/node_modules/@aashari/mcp-server-atlassian-jira \ +# /usr/local/lib/node_modules/@aashari/mcp-server-atlassian-confluence; do \ +# [ -d "$pkg_dir" ] && \ +# cd "$pkg_dir" && \ +# npm install --no-audit --no-fund \ +# @modelcontextprotocol/sdk@1.25.2 \ +# picomatch@4.0.4 \ +# || true; \ +# done +# # Workspace and Claude config dir — owned by the built-in node user (uid 1000). # Pre-creating ~/.claude ensures the named volume is initialised with the # correct ownership when first mounted (Docker copies image content into