fix(deps): the end-to-end test framework ships in the production container #178

Nytt ärende

Stängd

öppnade 2026-08-02 16:07:23 +00:00 av supernaut · 0 kommentarer

supernaut kommenterad

2026-08-02 16:07:23 +00:00

Ägare

nightwatch is declared in dependencies rather than devDependencies. The Containerfile installs
production dependencies only — pnpm install --frozen-lockfile --prod at line 21 and
pnpm install --prod --frozen-lockfile at line 37 — so a WebDriver client and its whole closure is
installed into the image that serves the public site.

Nothing in src/ imports it. It is used by nightwatch.conf.js and scripts/e2e.mjs, both of which
run only on a developer machine, via the pre-push hook.

Roughly 24 MB of the runtime image is test tooling: selenium-webdriver (~18 MB), nightwatch
(~3.3 MB), axe-core (~2.9 MB), plus transitive dependencies. Beyond the size, a browser-automation
client with no runtime purpose is avoidable attack surface in a public-facing container.

This is independent of any test-framework decision — the same misplacement would ship whichever
framework is used, and it should be corrected before that work rather than folded into it.

What to do

Move nightwatch to devDependencies and refresh the lockfile. Check geckodriver and anything
else test-only at the same time.

Done when

nightwatch is in devDependencies
A --prod install tree contains no selenium-webdriver and no nightwatch
The end-to-end suite still runs locally
pnpm lint, pnpm check and pnpm test pass

`nightwatch` is declared in `dependencies` rather than `devDependencies`. The Containerfile installs production dependencies only — `pnpm install --frozen-lockfile --prod` at line 21 and `pnpm install --prod --frozen-lockfile` at line 37 — so a WebDriver client and its whole closure is installed into the image that serves the public site. Nothing in `src/` imports it. It is used by `nightwatch.conf.js` and `scripts/e2e.mjs`, both of which run only on a developer machine, via the `pre-push` hook. Roughly 24 MB of the runtime image is test tooling: `selenium-webdriver` (~18 MB), `nightwatch` (~3.3 MB), `axe-core` (~2.9 MB), plus transitive dependencies. Beyond the size, a browser-automation client with no runtime purpose is avoidable attack surface in a public-facing container. This is independent of any test-framework decision — the same misplacement would ship whichever framework is used, and it should be corrected before that work rather than folded into it. ## What to do Move `nightwatch` to `devDependencies` and refresh the lockfile. Check `geckodriver` and anything else test-only at the same time. ## Done when - [ ] `nightwatch` is in `devDependencies` - [ ] A `--prod` install tree contains no `selenium-webdriver` and no `nightwatch` - [ ] The end-to-end suite still runs locally - [ ] `pnpm lint`, `pnpm check` and `pnpm test` pass

supernaut lade till etiketterna

area/security

area/web

ready-for-implementation

type

bug

2026-08-02 16:07:39 +00:00

supernaut hänvisade till detta ärende från en ändringsförfrågan som kommer att stänga det

2026-08-02 16:10:16 +00:00

fix(deps): keep the end-to-end test framework out of the runtime image #179

supernaut refererade till detta ärende från en incheckning

2026-08-02 16:10:17 +00:00