security: remediate HIGH and CRITICAL vulnerabilities identified

[DeepDN]

• Update Node.js dependencies to address 30+ security vulnerabilities

• Add Yarn resolutions for axios (1.15.2), handlebars (4.7.9), flatted (3.4.2), fast-uri (3.1.2), minimatch (10.2.1), protobufjs (8.0.1), and other packages

• Create .trivyignore file to document unfixable OS-level CVEs awaiting upstream Debian patches (15 vulnerabilities in libc, libgnutls, systemd, etc.)

• Reduce Node.js HIGH/CRITICAL vulnerabilities

• Maintain backward compatibility with existing codebase

• Fixes: CVE-2026-42033, CVE-2026-42035, CVE-2026-42043, CVE-2026-42264,
  CVE-2026-33228, CVE-2026-33937-41, CVE-2026-6321-22, CVE-2026-35213,
  CVE-2026-26996, CVE-2026-4867, CVE-2026-33671, CVE-2026-41242,
  CVE-2026-23745

• Trivy scan results: 8 HIGH (Node.js), 15 HIGH/CRITICAL (OS - unfixable)

Summary by CodeRabbit

• Chores
  • Updated Docker base image to Node 22 for improved runtime performance
  • Added security vulnerability acknowledgment configuration file
  • Updated dependencies, including axios to 1.15.2 and multiple transitive dependencies

[coderabbitai]

Warning

Rate limit exceeded

@DeepDN has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 31 minutes and 50 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5a261c52-4189-45e1-9d88-50cd43566d4a

📥 Commits

Reviewing files that changed from the base of the PR and between 0a9629c and 120bb9c.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• Dockerfile

📝 Walkthrough

Walkthrough

This PR updates npm dependency versions, adjusts Docker base image tags to use broader version ranges, and adds a new Trivy security scanning configuration file that acknowledges known unfixable vulnerabilities in the Debian 12 base image.

Changes

Dependencies and Infrastructure Updates

Layer / File(s)	Summary
Package Dependency Updates package.json	axios is updated from 1.13.5 to 1.15.2; resolutions section expanded to pin transitive dependencies (flatted to 3.4.2, undici at 6.24.0, and others).
Docker Base Image Tags Dockerfile	Node base images loosened from pinned versions (22.22.0 and 22.22.0-slim) to broader tags (22 and 22-slim) in both builder and production stages.
Trivy Vulnerability Scanning Configuration .trivyignore	New file documenting acknowledged but unfixable CVEs in Debian 12 base image libraries (glibc, libcap2, libgcrypt20, libgnutls30, systemd, ncurses, zlib), grouped by component with rationale.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 Our dependencies are updated with care,
Base images broadened, vulnerabilities declared—
From axios to zlib, we manage the load,
Docker leans lighter down the build road.
With Trivy's acknowledgment, we pave the way,
Safer and lighter for another day! 🚀

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'security: remediate HIGH and CRITICAL vulnerabilities identified' directly and accurately describes the main change—remediating security vulnerabilities through dependency updates and vulnerability documentation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

.trivyignore (1)

1-32: ⚡ Quick win

Add review metadata for each ignored CVE to avoid permanent suppression.

Please add an owner/ticket and planned review date next to each ignored CVE so these exceptions don’t become indefinite and untracked.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.trivyignore around lines 1 - 32, For each CVE entry (e.g., CVE-2026-0861,
CVE-2026-4878, CVE-2026-41989, CVE-2026-33845, CVE-2026-33846, CVE-2026-3833,
CVE-2026-42010, CVE-2026-42011, CVE-2026-29111, CVE-2025-69720, CVE-2026-4879,
CVE-2023-45853) add inline review metadata consisting of an owner (team or
person), a tracking ticket/issue ID, and a planned review date (YYYY-MM-DD)
immediately after each CVE line so each ignored vulnerability has explicit
ownership and a scheduled re-evaluation date. Ensure the metadata format is
consistent for all entries (e.g., " # owner:team-or-person ticket:ABC-123
review:2026-07-01") and update any comment header to mention the metadata
convention so future reviewers follow it.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile`:
- Line 2: Replace the mutable base image tags used in the Dockerfile (the two
FROM instructions that reference node:22 and node:22-slim) with immutable image
digests: look up the current SHA256 digest for the exact Node 22 images you want
from the official registry (e.g., docker.io/library/node) and update each FROM
line to use the corresponding `@sha256`:<digest> form; ensure both the builder
stage (FROM node:22 ...) and the runtime stage (FROM node:22-slim ...) are
pinned to their specific digests so builds become reproducible and resistant to
supply-chain changes.

In `@package.json`:
- Around line 124-137: The resolutions block includes "@hapi/content": "6.0.1"
but the yarn.lock was not updated to enforce that version; run the package
manager lockfile resolution step to ensure the resolution is applied (e.g., run
yarn install or yarn install --check-files then yarn-deduplicate/rebuild lock as
your workflow requires) and verify yarn.lock contains `@hapi/content`@6.0.1;
update the lockfile commit so the forced resolution for "@hapi/content" is
present before merging.

---

Nitpick comments:
In @.trivyignore:
- Around line 1-32: For each CVE entry (e.g., CVE-2026-0861, CVE-2026-4878,
CVE-2026-41989, CVE-2026-33845, CVE-2026-33846, CVE-2026-3833, CVE-2026-42010,
CVE-2026-42011, CVE-2026-29111, CVE-2025-69720, CVE-2026-4879, CVE-2023-45853)
add inline review metadata consisting of an owner (team or person), a tracking
ticket/issue ID, and a planned review date (YYYY-MM-DD) immediately after each
CVE line so each ignored vulnerability has explicit ownership and a scheduled
re-evaluation date. Ensure the metadata format is consistent for all entries
(e.g., " # owner:team-or-person ticket:ABC-123 review:2026-07-01") and update
any comment header to mention the metadata convention so future reviewers follow
it.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: eb951f37-9464-4d8e-b830-8dc2d71629f7

📥 Commits

Reviewing files that changed from the base of the PR and between 21b0336 and 0a9629c.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (3)

• .trivyignore
• Dockerfile
• package.json

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud