security: remediate HIGH and CRITICAL vulnerabilities identified

.trivyignore

@@ -0,0 +1,31 @@
+# Trivy Ignore File
+# This file contains CVEs that are acknowledged but cannot be fixed at this time
+
+# Debian 12 (Bookworm) base image vulnerabilities with no available fixes
+# These CVEs are in the upstream Debian repositories and patches are not yet available
+
+# glibc vulnerabilities - affects libc-bin, libc6
+CVE-2026-0861
+
+# libcap2 vulnerability - privilege escalation via TOCTOU race condition
+CVE-2026-4878
+
+# libgcrypt20 vulnerability - DoS and buffer overflow
+CVE-2026-41989
+
+# libgnutls30 vulnerabilities - multiple security issues
+CVE-2026-33845
+CVE-2026-33846
+CVE-2026-3833
+CVE-2026-42010
+CVE-2026-42011
+
+# systemd vulnerabilities - affects libsystemd0, libudev1
+CVE-2026-29111
+
+# ncurses vulnerabilities - affects libtinfo6, ncurses-base, ncurses-bin
+CVE-2025-69720
+
+# zlib vulnerability
+CVE-2026-4879
+CVE-2023-45853

Dockerfile

@@ -1,5 +1,5 @@
 # Stage 1: Builder stage
-FROM node:22.22.0 AS builder
+FROM node:22.22.2 AS builder
 
 WORKDIR /app
 
@@ -19,7 +19,7 @@ RUN yarn global add patch-package
 RUN yarn build
 
 # Stage 2: Production stage  
-FROM node:22.22.0-slim
+FROM node:22.22.2-slim
 
 # Update system packages and install security updates
 RUN apt-get update && apt-get upgrade -y && \

package.json

@@ -69,7 +69,7 @@
     "@types/ref-struct-di": "^1.1.12",
     "@types/uuid": "^10.0.0",
     "@types/ws": "^8.18.1",
-    "axios": "1.13.5",
+    "axios": "1.15.2",
     "body-parser": "^2.2.0",
     "cors": "^2.8.5",
     "dotenv": "^16.5.0",
@@ -124,7 +124,16 @@
   "resolutions": {
     "@credo-ts/core": "0.6.2",
     "@credo-ts/askar": "0.6.2",
-    "flatted": "3.4.0",
-    "undici": "6.24.0"
+    "flatted": "3.4.2",
+    "undici": "6.24.0",
+    "axios": "1.15.2",
+    "handlebars": "4.7.9",
+    "fast-uri": "3.1.2",
+    "@hapi/content": "6.0.1",
+    "minimatch": "10.2.1",
+    "path-to-regexp": "0.1.13",
+    "picomatch": "4.0.4",
+    "protobufjs": "8.0.1",
+    "tar": "7.5.3"
   }
 }