security: remediate Trivy HIGH/CRITICAL findings

[braghettos]

Trivy HIGH/CRITICAL remediation

All open Trivy findings on this repo are on the ui/ frontend: vulnerable JS dependencies (both ui/package-lock.json and ui/pnpm-lock.yaml) plus two ui/Dockerfile misconfigs. There are no Go modules and no Trivy pod-security (KSV) findings on the shipped Helm chart, so no chart changes were needed.

Fixed

Dependency bumps — both lockfiles refreshed to fixed versions; package.json version ranges are unchanged (only a prismjs override was added). Newer within-range versions were pulled into the lockfiles:

package	was	now (fixed)
axios	1.9.0	1.19.0
react-router	7.6.0	7.18.2
vite	6.3.5	6.4.3
postcss	8.5.3	8.5.26
nanoid	3.3.11	3.3.18
form-data	4.0.5	4.0.6
follow-redirects	1.15.9	1.16.0 (CVE-2025-7783 critical)
rollup	4.41.0	4.62.4
fast-uri	3.0.6	3.1.5
yaml	2.8.0	2.9.0
flatted	3.3.3	3.4.4
lodash	4.17.21	4.18.1
glob	11.0.2	11.1.0
linkifyjs	4.3.1	4.3.3
minimatch	10.0.1	10.2.6
brace-expansion	1.1.11 / 2.0.1	1.1.18 / 5.0.9
picomatch	2.3.1 / 4.0.3	2.3.2 / 4.0.5
mdast-util-to-hast	13.2.0	13.2.1
js-yaml	4.1.0	4.3.1
prismjs	1.27.0 (nested)	1.30.0

• prismjs is pinned to ^1.30.0 via overrides + pnpm.overrides because refractor@3.6.0 (pulled by react-syntax-highlighter) hard-pins the vulnerable 1.27.0 transitively — a plain lockfile refresh cannot lift it.
• Verified: npm ci (added 1060 packages) + npm run build (vite build) both GREEN; pnpm install --frozen-lockfile consistency check GREEN.

Dockerfile (ui/Dockerfile)

• DS-0002 (HIGH, container runs as root): switched the runtime base to the official nginxinc/nginx-unprivileged:1.30-alpine (uid 101) + explicit runtime USER nginx. Build-time file ops run as root, runtime drops to non-root. Verified end-to-end: image builds, container runs as uid=101(nginx), the boot-time entrypoint sed still rewrites the listen port (conf.d is group-writable by the nginx user), and the SPA serves HTTP 200.
• DS-0026 (LOW, missing HEALTHCHECK): added a wget-based HEALTHCHECK on the configured listen port (FRONTEND_CONTAINER_PORT).

Deferred

• RBAC / pod-security (KSV-*): none flagged by Trivy on this repo.
• Go dependency bumps: N/A — no Go modules in this repo.
• MEDIUM/LOW dependency CVEs without an in-range fix are carried by the lockfile refresh where a fix exists; anything still requiring a major-version bump of a direct dependency (breaking-change risk) is left to Dependabot/human review rather than opening a red PR.

Build status

• npm ci: PASS · npm run build: PASS · pnpm --frozen-lockfile: PASS · docker build + container runtime (non-root, serves 200, healthcheck exit 0): PASS

🤖 Generated with Claude Code