Optimize Dockerfile to reduce image size

[n0vad3v]

This PR changes the Dockerfile for this project, introduces three changes:

1. Use Multi-staging build to reduce image size

n0vad3v/cusdis                              latest               bca878dab5c5   4 minutes ago    1.88GB
djyde/cusdis                                latest               5843238f22b9   4 weeks ago      2.57GB

2. Change base image from node:15.14.0-alpine3.10 to node:16-alpine3.15 as builder, similar to PR: Bump node base image version to 16.13.0. #161
3. Add npx browserslist@latest --update-db when building

However, there are still some security issues with the new image that needs to be fixed:

n0vad3v/cusdis (alpine 3.15.4)
==============================
Total: 2 (UNKNOWN: 0, LOW: 2, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

+--------------+------------------+----------+-------------------+---------------+--------------------------------------+
|   LIBRARY    | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                TITLE                 |
+--------------+------------------+----------+-------------------+---------------+--------------------------------------+
| libcrypto1.1 | CVE-2022-2097    | LOW      | 1.1.1n-r0         | 1.1.1q-r0     | openssl: AES OCB fails               |
|              |                  |          |                   |               | to encrypt some bytes                |
|              |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2022-2097 |
+--------------+                  +          +                   +               +                                      +
| libssl1.1    |                  |          |                   |               |                                      |
|              |                  |          |                   |               |                                      |
|              |                  |          |                   |               |                                      |
+--------------+------------------+----------+-------------------+---------------+--------------------------------------+

Node.js (node-pkg)
==================
Total: 37 (UNKNOWN: 0, LOW: 0, MEDIUM: 20, HIGH: 15, CRITICAL: 2)

+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+
|     LIBRARY      |  VULNERABILITY ID   | SEVERITY | INSTALLED VERSION |        FIXED VERSION        |                    TITLE                     |
+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+
| @prisma/sdk      | CVE-2021-21414      | HIGH     | 2.14.0            | 2.20.0                      | Command injection                            |
|                  |                     |          |                   |                             | vulnerability in @prisma/sdk                 |
|                  |                     |          |                   |                             | in getPackedPackage function                 |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-21414        |
+------------------+---------------------+          +-------------------+-----------------------------+----------------------------------------------+
| ansi-regex       | CVE-2021-3807       |          | 5.0.0             | 3.0.1, 4.1.1, 5.0.1, 6.0.1  | nodejs-ansi-regex: Regular                   |
|                  |                     |          |                   |                             | expression denial of service                 |
|                  |                     |          |                   |                             | (ReDoS) matching ANSI escape codes           |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-3807         |
+------------------+---------------------+          +-------------------+-----------------------------+----------------------------------------------+
| async            | CVE-2021-43138      |          | 3.2.0             | 2.6.4, 3.2.2                | Prototype Pollution in async                 |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-43138        |
+------------------+---------------------+          +-------------------+-----------------------------+----------------------------------------------+
| axios            | CVE-2021-3749       |          | 0.21.1            | 0.21.2                      | nodejs-axios: Regular expression             |
|                  |                     |          |                   |                             | denial of service in trim function           |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-3749         |
+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+
| browserslist     | CVE-2021-23364      | MEDIUM   | 4.16.4            | 4.16.5                      | browserslist: parsing of                     |
|                  |                     |          |                   |                             | invalid queries could result in              |
|                  |                     |          |                   |                             | Regular Expression Denial of...              |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-23364        |
+------------------+---------------------+          +-------------------+-----------------------------+----------------------------------------------+
| class-validator  | CVE-2019-18413      |          | 0.13.1            |                             | SQL Injection and Cross-site                 |
|                  |                     |          |                   |                             | Scripting in class-validator                 |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2019-18413        |
+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+
| follow-redirects | CVE-2022-0155       | HIGH     | 1.13.3            | 1.14.7                      | follow-redirects: Exposure of                |
|                  |                     |          |                   |                             | Private Personal Information                 |
|                  |                     |          |                   |                             | to an Unauthorized Actor                     |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2022-0155         |
+                  +---------------------+----------+                   +-----------------------------+----------------------------------------------+
|                  | CVE-2022-0536       | MEDIUM   |                   | 1.14.8                      | follow-redirects: Exposure                   |
|                  |                     |          |                   |                             | of Sensitive Information via                 |
|                  |                     |          |                   |                             | Authorization Header leak                    |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2022-0536         |
+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+
| glob-parent      | CVE-2020-28469      | HIGH     | 2.0.0             | 5.1.2                       | nodejs-glob-parent: Regular                  |
|                  |                     |          |                   |                             | expression denial of service                 |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2020-28469        |
+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+
| markdown-it      | CVE-2022-21670      | MEDIUM   | 12.0.6            | 12.3.2                      | markdown-it is a Markdown                    |
|                  |                     |          |                   |                             | parser. Prior to version                     |
|                  |                     |          |                   |                             | 1.3.2, special patt ......                   |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2022-21670        |
+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+
| minimist         | CVE-2021-44906      | CRITICAL | 1.2.5             | 1.2.6                       | minimist: prototype pollution                |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-44906        |
+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+
| nanoid           | CVE-2021-23566      | MEDIUM   | 3.1.22            | 3.1.31                      | nanoid: Information disclosure               |
|                  |                     |          |                   |                             | via valueOf() function                       |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-23566        |
+                  +                     +          +-------------------+                             +                                              +
|                  |                     |          | 3.1.30            |                             |                                              |
|                  |                     |          |                   |                             |                                              |
|                  |                     |          |                   |                             |                                              |
+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+
| next             | CVE-2021-43803      | HIGH     | 12.0.4            | 11.1.3, 12.0.5              | Unexpected server crash in Next.js.          |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-43803        |
+                  +---------------------+----------+                   +-----------------------------+----------------------------------------------+
|                  | CVE-2022-21721      | MEDIUM   |                   | 12.0.9                      | Denial of Service                            |
|                  |                     |          |                   |                             | Vulnerability in next.js                     |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2022-21721        |
+                  +---------------------+          +                   +-----------------------------+----------------------------------------------+
|                  | CVE-2022-23646      |          |                   | 12.1.0                      | Improper CSP in Image                        |
|                  |                     |          |                   |                             | Optimization API for Next.js                 |
|                  |                     |          |                   |                             | versions between 10.0.0 and...               |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2022-23646        |
+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+
| next-auth        | CVE-2022-31093      | HIGH     | 3.15.5            | 4.5.0, 3.29.5               | Improper Handling of `callbackUrl`           |
|                  |                     |          |                   |                             | parameter in next-auth                       |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2022-31093        |
+                  +---------------------+          +                   +-----------------------------+----------------------------------------------+
|                  | CVE-2022-31127      |          |                   | 4.9.0, 3.29.8               | Improper handling of email input             |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2022-31127        |
+                  +---------------------+----------+                   +-----------------------------+----------------------------------------------+
|                  | CVE-2022-24858      | MEDIUM   |                   | 4.3.2, 3.29.2               | NextAuth.js default redirect                 |
|                  |                     |          |                   |                             | callback vulnerable to open redirects        |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2022-24858        |
+                  +---------------------+          +                   +-----------------------------+----------------------------------------------+
|                  | CVE-2022-29214      |          |                   | 4.3.3, 3.29.3               | URL Redirection to Untrusted Site            |
|                  |                     |          |                   |                             | ('Open Redirect') in next-auth               |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2022-29214        |
+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+
| node-fetch       | CVE-2022-0235       | HIGH     | 2.6.1             | 2.6.7, 3.1.1                | node-fetch: exposure of sensitive            |
|                  |                     |          |                   |                             | information to an unauthorized actor         |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2022-0235         |
+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+
| nodemailer       | CVE-2021-23400      | MEDIUM   | 6.5.0             | 6.6.1                       | The package nodemailer                       |
|                  |                     |          |                   |                             | before 6.6.1 are vulnerable                  |
|                  |                     |          |                   |                             | to HTTP Header Inje ......                   |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-23400        |
+------------------+---------------------+          +-------------------+-----------------------------+----------------------------------------------+
| path-parse       | CVE-2021-23343      |          | 1.0.6             | 1.0.7                       | nodejs-path-parse:                           |
|                  |                     |          |                   |                             | ReDoS via splitDeviceRe,                     |
|                  |                     |          |                   |                             | splitTailRe and splitPathRe                  |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-23343        |
+------------------+---------------------+          +-------------------+-----------------------------+----------------------------------------------+
| postcss          | CVE-2021-23382      |          | 6.0.23            | 7.0.36, 8.2.13              | nodejs-postcss: ReDoS                        |
|                  |                     |          |                   |                             | via getAnnotationURL()                       |
|                  |                     |          |                   |                             | and loadAnnotation()                         |
|                  |                     |          |                   |                             | in lib/previous-map.js                       |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-23382        |
+                  +                     +          +-------------------+                             +                                              +
|                  |                     |          | 8.2.10            |                             |                                              |
|                  |                     |          |                   |                             |                                              |
|                  |                     |          |                   |                             |                                              |
|                  |                     |          |                   |                             |                                              |
|                  |                     |          |                   |                             |                                              |
+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+
| tar              | CVE-2021-32803      | HIGH     | 6.1.0             | 6.1.2, 5.0.7, 4.4.15, 3.2.3 | nodejs-tar: Insufficient symlink             |
|                  |                     |          |                   |                             | protection allowing arbitrary                |
|                  |                     |          |                   |                             | file creation and overwrite                  |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-32803        |
+                  +---------------------+          +                   +-----------------------------+----------------------------------------------+
|                  | CVE-2021-32804      |          |                   | 6.1.1, 5.0.6, 4.4.14, 3.2.2 | nodejs-tar: Insufficient absolute            |
|                  |                     |          |                   |                             | path sanitization allowing arbitrary         |
|                  |                     |          |                   |                             | file creation and overwrite                  |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-32804        |
+                  +---------------------+          +                   +-----------------------------+----------------------------------------------+
|                  | CVE-2021-37701      |          |                   | 6.1.7, 5.0.8, 4.4.16        | nodejs-tar: Insufficient symlink             |
|                  |                     |          |                   |                             | protection due to directory cache            |
|                  |                     |          |                   |                             | poisoning using symbolic links...            |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-37701        |
+                  +---------------------+          +                   +-----------------------------+----------------------------------------------+
|                  | CVE-2021-37712      |          |                   | 6.1.9, 5.0.10, 4.4.18       | nodejs-tar: Insufficient symlink             |
|                  |                     |          |                   |                             | protection due to directory cache            |
|                  |                     |          |                   |                             | poisoning using symbolic links...            |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-37712        |
+                  +---------------------+          +                   +                             +----------------------------------------------+
|                  | CVE-2021-37713      |          |                   |                             | nodejs-tar: Arbitrary                        |
|                  |                     |          |                   |                             | File Creation/Overwrite on                   |
|                  |                     |          |                   |                             | Windows via insufficient                     |
|                  |                     |          |                   |                             | relative path sanitization                   |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-37713        |
+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+
| url-parse        | CVE-2022-0686       | CRITICAL | 1.5.1             | 1.5.8                       | npm-url-parse: Authorization                 |
|                  |                     |          |                   |                             | bypass through user-controlled key           |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2022-0686         |
+                  +---------------------+----------+                   +-----------------------------+----------------------------------------------+
|                  | CVE-2021-3664       | MEDIUM   |                   | 1.5.2                       | nodejs-url-parse: URL                        |
|                  |                     |          |                   |                             | Redirection to Untrusted Site                |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-3664         |
+                  +---------------------+          +                   +-----------------------------+----------------------------------------------+
|                  | CVE-2022-0512       |          |                   | 1.5.6                       | nodejs-url-parse: authorization              |
|                  |                     |          |                   |                             | bypass through user-controlled key           |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2022-0512         |
+                  +---------------------+          +                   +-----------------------------+----------------------------------------------+
|                  | CVE-2022-0639       |          |                   | 1.5.7                       | npm-url-parse: Authorization                 |
|                  |                     |          |                   |                             | Bypass Through User-Controlled Key           |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2022-0639         |
+                  +---------------------+          +                   +-----------------------------+----------------------------------------------+
|                  | CVE-2022-0691       |          |                   | 1.5.9                       | npm-url-parse: authorization                 |
|                  |                     |          |                   |                             | bypass through user-controlled key           |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2022-0691         |
+------------------+---------------------+          +-------------------+-----------------------------+----------------------------------------------+
| validator        | CVE-2021-3765       |          | 13.6.0            | 13.7.0                      | validator.js is vulnerable                   |
|                  |                     |          |                   |                             | to Inefficient Regular                       |
|                  |                     |          |                   |                             | Expression Complexit ...                     |
|                  |                     |          |                   |                             | -->avd.aquasec.com/nvd/cve-2021-3765         |
+                  +---------------------+          +                   +                             +----------------------------------------------+
|                  | GHSA-xx4c-jj58-r7x6 |          |                   |                             | Inefficient Regular Expression               |
|                  |                     |          |                   |                             | Complexity in Validator.js                   |
|                  |                     |          |                   |                             | -->github.com/advisories/GHSA-xx4c-jj58-r7x6 |
+------------------+---------------------+----------+-------------------+-----------------------------+----------------------------------------------+

app/node_modules/esbuild/bin/esbuild (gobinary)
===============================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

[vercel]

Someone is attempting to deploy a commit to a Personal Account owned by @djyde on Vercel.

@djyde first needs to authorize it.

[n0vad3v]

Maybe we can change Vercel check here as it seems shows fail on every PR 🤔.

[n0vad3v]

I've added a workflow on GitHub action which will run on every PR, it will try to build the image and use trivy to scan the newly built image for security issues and then comment on PR.

[djyde]

nice work!

[djyde]

Could you please make a new PR that target the main branch?

[n0vad3v]

OK, so what's happening in #210?

[n0vad3v]

I've created PR at: #211