[pull] main from formbricks:main

.github/workflows/docker-build-validation.yml

@@ -74,6 +74,19 @@ jobs:
             cubejs_api_url=http://localhost:4000
             cubejs_api_secret=build-time-placeholder
 
+      - name: Verify Runtime Image Excludes npm
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          docker run --rm --entrypoint sh "formbricks-test:$GITHUB_SHA" -c '
+            set -eu
+            test ! -d /usr/local/lib/node_modules/npm
+            ! command -v npm >/dev/null 2>&1
+            ! command -v npx >/dev/null 2>&1
+            node --version
+          '
+
       - name: Reject Invalid Environment Before Database Setup
         shell: bash
         env:

apps/web/Dockerfile

@@ -80,10 +80,11 @@ RUN --mount=type=secret,id=database_url \
 #
 FROM base AS runner
 
-# Upgrade Alpine system packages to pick up security patches, update npm to the patched 11.x line, then create user
-# Note: npm is updated in the runtime image so any bundled transitive packages scanned from the base image are patched
+# Upgrade Alpine system packages, remove build-only npm tooling from the runtime image, then create user.
+# The application and startup migrations run directly with Node.js; npm and npx are only needed in the installer.
 RUN apk update && apk upgrade --no-cache \
-    && npm install --ignore-scripts -g npm@11.17.0 \
+    && rm -rf /usr/local/lib/node_modules/npm \
+    && rm -f /usr/local/bin/npm /usr/local/bin/npx \
     && addgroup -S nextjs \
     && adduser -S -u 1001 -G nextjs nextjs
 

docs/surveys/general-features/multi-language-surveys.mdx

@@ -10,16 +10,6 @@ How to deliver a specific language depends on the survey type (app or link surve
 
 - Link survey: Add a `lang` parameter in the survey URL. [Read this guide for Link Surveys](#link-surveys-configuration)
 
-<iframe
-  width="560"
-  height="315"
-  src="https://www.youtube-nocookie.com/embed/Vol5zjYIoos?si=bdP2y3uk8-xR0uSD&controls=0"
-  title="Formbricks Multi-language Surveys"
-  frameborder="0"
-  allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
-  allowfullscreen
-/>
-
 ---
 
 ## Creating a Multi-language Survey

docs/surveys/link-surveys/source-tracking.mdx

@@ -6,10 +6,6 @@ icon: "display-chart-up"
 
 Understand the source a survey respondent comes from when responding to your survey – all while keeping data privacy standards high!
 
-Check out this video to learn more about source tracking in link surveys:
-
-<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/CytWhuyEMVI?si=nxRrdMmlsQ5P6wwp&amp;controls=0" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
-
 ## Purpose
 
 Source tracking for link surveys is essential when you: