fix: Dockerfile to reduce vulnerabilities (#260)

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314623
- https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314624
- https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314624
- https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314641
- https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314643

Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 node:18.12.1-alpine3.16 as base
+FROM --platform=linux/amd64 node:18-alpine3.16 as base
 
 RUN apk --update --no-cache add --virtual .builds-deps build-base python3
 

lib/utils/http-requestor.js

@@ -2,7 +2,6 @@ const {Client, Pool} = require('undici');
 const parseUrl = require('parse-url');
 const assert = require('assert');
 const BaseRequestor = require('./base-requestor');
-const WsRequestor = require('./ws-requestor');
 const {HookMsgTypes} = require('./constants.json');
 const snakeCaseKeys = require('./snakecase-keys');
 const pools = new Map();
@@ -94,6 +93,7 @@ class HttpRequestor extends BaseRequestor {
 
     /* if we have an absolute url, and it is ws then do a websocket connection */
     if (this._isAbsoluteUrl(url) && url.startsWith('ws')) {
+      const WsRequestor = require('./ws-requestor');
       this.logger.debug({hook}, 'HttpRequestor: switching to websocket connection');
       const h = typeof hook === 'object' ? hook : {url: hook};
       const requestor = new WsRequestor(this.logger, this.account_sid, h, this.secret);

lib/utils/ws-requestor.js

@@ -4,7 +4,6 @@ const short = require('short-uuid');
 const {HookMsgTypes} = require('./constants.json');
 const Websocket = require('ws');
 const snakeCaseKeys = require('./snakecase-keys');
-const HttpRequestor = require('./http-requestor');
 const MAX_RECONNECTS = 5;
 const RESPONSE_TIMEOUT_MS = process.env.JAMBONES_WS_API_MSG_RESPONSE_TIMEOUT || 5000;
 
@@ -53,6 +52,7 @@ class WsRequestor extends BaseRequestor {
 
     /* if we have an absolute url, and it is http then do a standard webhook */
     if (this._isAbsoluteUrl(url) && url.startsWith('http')) {
+      const HttpRequestor = require('./http-requestor');
       this.logger.debug({hook}, 'WsRequestor: sending a webhook (HTTP)');
       const h = typeof hook === 'object' ? hook : {url: hook};
       const requestor = new HttpRequestor(this.logger, this.account_sid, h, this.secret);