# Vulnerability patching of npm/gem dependencies in discourse

**URL:** https://meta.discourse.org/t/vulnerability-patching-of-npm-gem-dependencies-in-discourse/385400
**Category:** Self-hosting
**Tags:** docker
**Created:** [13 oktober 2025 om 06:20 UTC](https://meta.discourse.org/t/vulnerability-patching-of-npm-gem-dependencies-in-discourse/385400 "2025-10-13T06:20:50Z")
**Posts on this page:** 1
**Showing post:** 1

<div class="post-metadata">

### Author: ![harishg33](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/harishg33/32/496490_2.png) [@harishg33](https://meta.discourse.org/u/harishg33)
#### Post date: [13 oktober 2025 om 06:20 UTC](https://meta.discourse.org/t/vulnerability-patching-of-npm-gem-dependencies-in-discourse/385400/1 "2025-10-13T06:20:50Z")

</div>

Our organization requires us to patch all High/Critical vulnerabilities in our docker images, before we could deploy them to production. Currently our build of discourse, which is based on `discourse/base:2.0.20251008-0017-web-only`, has a few of them which we are trying to patch if possible. Below is the list of vulnerabilities we need to patch.

[vuln-report-opencves.txt](https://meta.discourse.org/uploads/short-url/6Mz4J5vpujFRWhsQ2X4EDRdWziX.txt) (2.3 KB)

Could you give me any guidance on whether updating any of these blindly to versions which have fixed these vulnerabilities, will cause any issues ? If yes, how can we find out if an upgrade is causing an issue ?

Also, I notice that there are lots of golang related vulnerabilities. Does discourse use golang in any way during the runtime, or can we just completely purge it from the final image ? Same goes for `python` too.

---

_[View the full topic](https://meta.discourse.org/t/vulnerability-patching-of-npm-gem-dependencies-in-discourse/385400)._