Joel Brock
fe9bfed0d6
Next 16.2.6 carried ~20 advisories fixed in 16.4.x, including unauthenticated RCE in the Image Optimization API (GHSA-2xp9-vwfh-vxw4, GHSA-2464-fhr4-w9xw) and SSG/ISR cache poisoning (GHSA-mcj8-r9mp-w47p). npm audit fix clears the remaining sharp/postcss/source-map-js/nanoid findings; npm audit now reports 0 vulnerabilities. Node 20 is EOL and receives no fix for Node2Shell (CVE-2026-111497, bundled Brotli decoder OOB write). Pin .nvmrc and render.yaml to Node 24 LTS; Amplify SSR compute runs the major version used at build time.
38 lines
1.1 KiB
YAML
38 lines
1.1 KiB
YAML
# Render Blueprint — https://render.com/docs/blueprint-spec
|
|
#
|
|
# Deploy this app as a Web Service on Render. Push to your default branch
|
|
# triggers a deploy. Set the four CIVI_* env vars in the Render dashboard
|
|
# (mark them as "Sync: false" so they're not overwritten by this file).
|
|
|
|
services:
|
|
- type: web
|
|
name: coop-checkin
|
|
runtime: node
|
|
plan: starter
|
|
region: oregon
|
|
buildCommand: npm ci && npm run build
|
|
startCommand: npm run start
|
|
healthCheckPath: /healthz
|
|
envVars:
|
|
- key: NODE_ENV
|
|
value: production
|
|
- key: NODE_VERSION
|
|
value: "24"
|
|
# Set these manually in the Render dashboard (UI → Environment).
|
|
# Marked sync:false so they're not echoed in this committed file.
|
|
- key: CIVI_BASE_URL
|
|
sync: false
|
|
- key: CIVI_API_KEY
|
|
sync: false
|
|
- key: CIVI_SITE_KEY
|
|
sync: false
|
|
- key: CIVI_HTTP_AUTH_USER
|
|
sync: false
|
|
- key: CIVI_HTTP_AUTH_PASS
|
|
sync: false
|
|
- key: HEALTH_TOKEN
|
|
sync: false
|
|
- key: PUBLIC_ORIGIN
|
|
sync: false
|
|
autoDeploy: true
|