From 89c60a072c89d3332b4a25cd49d18f469740e46d Mon Sep 17 00:00:00 2001 From: JOY Date: Sat, 12 Sep 2026 08:20:18 +0000 Subject: [PATCH 1/2] fix(docker): refuse boot on default secrets, disable Prisma Studio, shrink GHA cache export The image baked NEXTAUTH_SECRET=secret and CALENDSO_ENCRYPTION_KEY=secret as ARG defaults, so anyone could forge session JWTs or decrypt stored OAuth credentials on a deployment that forgot to set them. The defaults are gone; CI passes an explicit build-time placeholder because next.config.ts asserts both during next build, and the runner stage never carries them, so the real value has to come from the runtime environment. start.sh now refuses to boot on an unset, 'secret', or placeholder value. Also adds NEXT_PUBLIC_SENDER_ID and NEXT_PUBLIC_SENDGRID_SENDER_NAME build args so branding stays configurable, and switches cache-to from mode=max (which exported the secret-bearing builder stage into the shared Actions cache) to mode=min. --- .github/workflows/deploy-docker.yml | 5 +++++ Dockerfile | 12 ++++++++++-- scripts/start.sh | 28 +++++++++++++++------------- 3 files changed, 30 insertions(+), 15 deletions(-) diff --git a/.github/workflows/deploy-docker.yml b/.github/workflows/deploy-docker.yml index 7f3be31866d..de73ee280ed 100644 --- a/.github/workflows/deploy-docker.yml +++ b/.github/workflows/deploy-docker.yml @@ -49,6 +49,11 @@ jobs: # shared Actions cache. mode=min exports only the final image layers. cache-to: type=gha,mode=min build-args: | + # Build-time only: next.config.ts asserts these during `next build`. The runner + # stage does not carry them, so the real values must come from the runtime + # environment - scripts/start.sh refuses to boot when they are missing. + NEXTAUTH_SECRET=build-time-placeholder-not-used-at-runtime + CALENDSO_ENCRYPTION_KEY=build-time-placeholder-not-used-at-runtime NEXT_PUBLIC_WEBAPP_URL=https://cal.crove.com NEXT_PUBLIC_API_V2_URL=http://localhost:5555/api/v2 NEXT_PUBLIC_LICENSE_CONSENT=agree diff --git a/Dockerfile b/Dockerfile index b48a4747537..854f1fdea0e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,8 +8,12 @@ ARG NEXT_PUBLIC_WEBSITE_TERMS_URL ARG NEXT_PUBLIC_WEBSITE_PRIVACY_POLICY_URL ARG CALCOM_TELEMETRY_DISABLED ARG DATABASE_URL -ARG NEXTAUTH_SECRET=secret -ARG CALENDSO_ENCRYPTION_KEY=secret +# CR-08: no insecure "=secret" defaults — publicly-known values must never be baked into images. +# Build-time placeholders are supplied by CI (deploy-docker.yml) because next.config.ts requires +# these to be set during `next build`; real values must be provided at runtime (start.sh refuses +# to boot when they are unset or equal to the old default). +ARG NEXTAUTH_SECRET +ARG CALENDSO_ENCRYPTION_KEY ARG MAX_OLD_SPACE_SIZE=6144 ARG NEXT_PUBLIC_API_V2_URL ARG CSP_POLICY @@ -21,6 +25,8 @@ ARG NEXT_PUBLIC_ENABLE_PROFILE_SWITCHER=1 ARG NEXT_PUBLIC_APP_NAME=Crove ARG NEXT_PUBLIC_COMPANY_NAME="MetaDOS LLC" ARG NEXT_PUBLIC_SUPPORT_MAIL_ADDRESS=help@crove.com +ARG NEXT_PUBLIC_SENDER_ID=Crove +ARG NEXT_PUBLIC_SENDGRID_SENDER_NAME=Crove ARG NEXT_PUBLIC_DOS_ID_LOGIN_ENABLED=true ARG OIDC_CLIENT_ID=18790ccb-4d71-48cd-ad24-aee5f3ced3da @@ -33,6 +39,8 @@ ENV NEXT_PUBLIC_WEBAPP_URL=http://NEXT_PUBLIC_WEBAPP_URL_PLACEHOLDER \ NEXT_PUBLIC_APP_NAME=$NEXT_PUBLIC_APP_NAME \ NEXT_PUBLIC_COMPANY_NAME=$NEXT_PUBLIC_COMPANY_NAME \ NEXT_PUBLIC_SUPPORT_MAIL_ADDRESS=$NEXT_PUBLIC_SUPPORT_MAIL_ADDRESS \ + NEXT_PUBLIC_SENDER_ID=$NEXT_PUBLIC_SENDER_ID \ + NEXT_PUBLIC_SENDGRID_SENDER_NAME=$NEXT_PUBLIC_SENDGRID_SENDER_NAME \ NEXT_PUBLIC_ENABLE_PROFILE_SWITCHER=$NEXT_PUBLIC_ENABLE_PROFILE_SWITCHER \ OIDC_CLIENT_ID=$OIDC_CLIENT_ID \ CALCOM_TELEMETRY_DISABLED=$CALCOM_TELEMETRY_DISABLED \ diff --git a/scripts/start.sh b/scripts/start.sh index 7c00c8e6611..7e024b98aff 100644 --- a/scripts/start.sh +++ b/scripts/start.sh @@ -1,19 +1,21 @@ #!/bin/sh set -x -# CR-08 startup guard: refuse to boot when secrets are missing or equal the old -# publicly-known insecure default "secret". Real values must come from the runtime -# environment (docker-compose env_file / docker run -e), never from the image. -if [ -z "$NEXTAUTH_SECRET" ] || [ "$NEXTAUTH_SECRET" = "secret" ]; then - echo "ERROR: NEXTAUTH_SECRET is unset or equals the insecure default 'secret'." - echo "Set a strong random value at runtime, e.g.: openssl rand -base64 32" - exit 1 -fi -if [ -z "$CALENDSO_ENCRYPTION_KEY" ] || [ "$CALENDSO_ENCRYPTION_KEY" = "secret" ]; then - echo "ERROR: CALENDSO_ENCRYPTION_KEY is unset or equals the insecure default 'secret'." - echo "Set a strong random value at runtime, e.g.: openssl rand -base64 32" - exit 1 -fi +# CR-08 startup guard: refuse to boot when a secret is missing or set to a publicly-known +# value. The build stage passes a placeholder because next.config.ts asserts these during +# `next build`; the runner stage does not carry them, so the real value must come from the +# runtime environment (docker-compose env_file / docker run -e). +reject_insecure_secret() { + case "$2" in + "" | "secret" | "build-time-placeholder-not-used-at-runtime") + echo "ERROR: $1 is unset or set to a publicly-known value." + echo "Set a strong random value at runtime, e.g.: openssl rand -base64 32" + exit 1 + ;; + esac +} +reject_insecure_secret NEXTAUTH_SECRET "$NEXTAUTH_SECRET" +reject_insecure_secret CALENDSO_ENCRYPTION_KEY "$CALENDSO_ENCRYPTION_KEY" # Replace the statically built BUILT_NEXT_PUBLIC_WEBAPP_URL with run-time NEXT_PUBLIC_WEBAPP_URL # NOTE: if these values are the same, this will be skipped. From 1f07966f7e34dc5c90b0005d845587c27dea9aed Mon Sep 17 00:00:00 2001 From: JOY Date: Sat, 12 Sep 2026 08:22:10 +0000 Subject: [PATCH 2/2] fix(deps): bump example-app next to 15.5.24 for critical advisories --- example-apps/credential-sync/package.json | 2 +- yarn.lock | 88 +++++++++++------------ 2 files changed, 45 insertions(+), 45 deletions(-) diff --git a/example-apps/credential-sync/package.json b/example-apps/credential-sync/package.json index a784cfce53d..a247fdad076 100644 --- a/example-apps/credential-sync/package.json +++ b/example-apps/credential-sync/package.json @@ -10,7 +10,7 @@ "dependencies": { "@calcom/atoms": "workspace:*", "@prisma/client": "6.16.1", - "next": "15.5.21", + "next": "15.5.24", "prisma": "6.16.1", "react": "18.2.0", "react-dom": "18.2.0" diff --git a/yarn.lock b/yarn.lock index bc88ee5954b..7e93964e688 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2424,7 +2424,7 @@ __metadata: "@types/react-dom": "npm:18.2.6" autoprefixer: "npm:10.4.19" dotenv: "npm:16.6.1" - next: "npm:15.5.21" + next: "npm:15.5.24" postcss: "npm:8.5.6" prisma: "npm:6.16.1" react: "npm:18.2.0" @@ -8732,10 +8732,10 @@ __metadata: languageName: node linkType: hard -"@next/env@npm:15.5.21": - version: 15.5.21 - resolution: "@next/env@npm:15.5.21" - checksum: 10/cac7c51fd255dbd79f32f8dd9895573207ed273e94ce92087cfa0283b0ad3a9685741e4ed934d76161914cc6259a908fd6e439cc6a9aeb8d67090f973c949d3b +"@next/env@npm:15.5.24": + version: 15.5.24 + resolution: "@next/env@npm:15.5.24" + checksum: 10/76da9f6dd5c890b9a7e584c9379a639e13a7ead41410c0743e23790990ef95bc1f797443b246322582535c2e9b3aa8dc88d175bf5e39e55e5ac2b9d83c497918 languageName: node linkType: hard @@ -8753,9 +8753,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-darwin-arm64@npm:15.5.21": - version: 15.5.21 - resolution: "@next/swc-darwin-arm64@npm:15.5.21" +"@next/swc-darwin-arm64@npm:15.5.24": + version: 15.5.24 + resolution: "@next/swc-darwin-arm64@npm:15.5.24" conditions: os=darwin & cpu=arm64 languageName: node linkType: hard @@ -8774,9 +8774,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-darwin-x64@npm:15.5.21": - version: 15.5.21 - resolution: "@next/swc-darwin-x64@npm:15.5.21" +"@next/swc-darwin-x64@npm:15.5.24": + version: 15.5.24 + resolution: "@next/swc-darwin-x64@npm:15.5.24" conditions: os=darwin & cpu=x64 languageName: node linkType: hard @@ -8795,9 +8795,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-linux-arm64-gnu@npm:15.5.21": - version: 15.5.21 - resolution: "@next/swc-linux-arm64-gnu@npm:15.5.21" +"@next/swc-linux-arm64-gnu@npm:15.5.24": + version: 15.5.24 + resolution: "@next/swc-linux-arm64-gnu@npm:15.5.24" conditions: os=linux & cpu=arm64 & libc=glibc languageName: node linkType: hard @@ -8816,9 +8816,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-linux-arm64-musl@npm:15.5.21": - version: 15.5.21 - resolution: "@next/swc-linux-arm64-musl@npm:15.5.21" +"@next/swc-linux-arm64-musl@npm:15.5.24": + version: 15.5.24 + resolution: "@next/swc-linux-arm64-musl@npm:15.5.24" conditions: os=linux & cpu=arm64 & libc=musl languageName: node linkType: hard @@ -8837,9 +8837,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-linux-x64-gnu@npm:15.5.21": - version: 15.5.21 - resolution: "@next/swc-linux-x64-gnu@npm:15.5.21" +"@next/swc-linux-x64-gnu@npm:15.5.24": + version: 15.5.24 + resolution: "@next/swc-linux-x64-gnu@npm:15.5.24" conditions: os=linux & cpu=x64 & libc=glibc languageName: node linkType: hard @@ -8858,9 +8858,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-linux-x64-musl@npm:15.5.21": - version: 15.5.21 - resolution: "@next/swc-linux-x64-musl@npm:15.5.21" +"@next/swc-linux-x64-musl@npm:15.5.24": + version: 15.5.24 + resolution: "@next/swc-linux-x64-musl@npm:15.5.24" conditions: os=linux & cpu=x64 & libc=musl languageName: node linkType: hard @@ -8879,9 +8879,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-win32-arm64-msvc@npm:15.5.21": - version: 15.5.21 - resolution: "@next/swc-win32-arm64-msvc@npm:15.5.21" +"@next/swc-win32-arm64-msvc@npm:15.5.24": + version: 15.5.24 + resolution: "@next/swc-win32-arm64-msvc@npm:15.5.24" conditions: os=win32 & cpu=arm64 languageName: node linkType: hard @@ -8900,9 +8900,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-win32-x64-msvc@npm:15.5.21": - version: 15.5.21 - resolution: "@next/swc-win32-x64-msvc@npm:15.5.21" +"@next/swc-win32-x64-msvc@npm:15.5.24": + version: 15.5.24 + resolution: "@next/swc-win32-x64-msvc@npm:15.5.24" conditions: os=win32 & cpu=x64 languageName: node linkType: hard @@ -32237,23 +32237,23 @@ __metadata: languageName: node linkType: hard -"next@npm:15.5.21": - version: 15.5.21 - resolution: "next@npm:15.5.21" +"next@npm:15.5.24": + version: 15.5.24 + resolution: "next@npm:15.5.24" dependencies: - "@next/env": "npm:15.5.21" - "@next/swc-darwin-arm64": "npm:15.5.21" - "@next/swc-darwin-x64": "npm:15.5.21" - "@next/swc-linux-arm64-gnu": "npm:15.5.21" - "@next/swc-linux-arm64-musl": "npm:15.5.21" - "@next/swc-linux-x64-gnu": "npm:15.5.21" - "@next/swc-linux-x64-musl": "npm:15.5.21" - "@next/swc-win32-arm64-msvc": "npm:15.5.21" - "@next/swc-win32-x64-msvc": "npm:15.5.21" + "@next/env": "npm:15.5.24" + "@next/swc-darwin-arm64": "npm:15.5.24" + "@next/swc-darwin-x64": "npm:15.5.24" + "@next/swc-linux-arm64-gnu": "npm:15.5.24" + "@next/swc-linux-arm64-musl": "npm:15.5.24" + "@next/swc-linux-x64-gnu": "npm:15.5.24" + "@next/swc-linux-x64-musl": "npm:15.5.24" + "@next/swc-win32-arm64-msvc": "npm:15.5.24" + "@next/swc-win32-x64-msvc": "npm:15.5.24" "@swc/helpers": "npm:0.5.15" caniuse-lite: "npm:^1.0.30001579" postcss: "npm:8.4.31" - sharp: "npm:^0.34.3" + sharp: "npm:^0.34.3 || ^0.35.3" styled-jsx: "npm:5.1.6" peerDependencies: "@opentelemetry/api": ^1.1.0 @@ -32292,7 +32292,7 @@ __metadata: optional: true bin: next: dist/bin/next - checksum: 10/caa65d7b05399092d0135738f4dd6553d025fb4701f3e0dce4693f1e92591d8c1944db6c9470ae09f65397c87c8469d278fb1fb9de1eac2fb549941d64a15690 + checksum: 10/fb31550dba1fdef53d4cea8a59eac895011a4cc3d49c902da430d5b7fdaa46d9ec904d61aa48f2b7c8714059ca0372995060a9d94d3ff4b2bd2bea15b174e489 languageName: node linkType: hard @@ -37879,7 +37879,7 @@ __metadata: languageName: node linkType: hard -"sharp@npm:^0.35.3": +"sharp@npm:^0.34.3 || ^0.35.3, sharp@npm:^0.35.3": version: 0.35.4 resolution: "sharp@npm:0.35.4" dependencies: