fix(security): resolve 2026 vulnerability backlog

[jmgasper]

Summary

• Resolves the complete 294-alert Dependabot inventory: 210 vulnerable packages upgraded to patched versions and 84 removed, with 0 unresolved alerts in either lockfile.
• Replaces the legacy Node 10 / Debian 9 production image design with a digest-pinned Node 24.18.0 Alpine 3.23 multi-stage image, a non-root runtime, direct Node startup, and no npm/Yarn/Corepack/build toolchain in production.
• Remediates all 15 open CodeQL findings covering SSRF, DOM XSS, ReDoS, authentication/rate-limit ordering, permissive CORS, stack disclosure, unbounded input, workflow permissions, password logging, and identity replacement.
• Removes tracked credential defaults and build-layer secret arguments, makes JWT configuration fail closed, and documents the required runtime configuration.
• Modernizes the dependency/build/test stack needed to safely install, test, build, and run on Node 24, including maintained XML/markdown/service-worker implementations and narrow compatibility adapters for legacy package APIs.
• Removes the obsolete JMeter dependency graph responsible for 134 Trivy findings and upgrades the performance-test runtime to JMeter 5.6.3 on a digest-pinned JDK 17/Maven 3.9 image.

Root causes addressed

The ECR development image community-app:18396 (sha256:8ce078b78d314534987fbea930fb511ca0fa881e7b066cbfcbbe014d122513ee) contained 355 active Inspector findings (40 critical, 174 high, 129 medium, 12 low). Its primary causes were the end-of-life Node 10 / Debian 9 base, production inclusion of npm and build tooling, vulnerable dependency locks, and secrets passed through image history.

The GitHub backlog consisted of 294 Dependabot alerts across the root and smoke-test locks plus 15 CodeQL alerts. The completion audit also found 134 historical Trivy results in the Maven performance-test dependency graph (18 critical, 70 high, 44 medium, 2 low). This branch maps every Dependabot alert to a patched or removed package, adds focused regression tests for the CodeQL fixes, and removes the redundant Maven dependencies that introduced the Trivy findings.

Validation

• Root npm audit --include=dev: 0 vulnerabilities across 1,916 dependencies.
• Smoke-test npm audit --include=dev: 0 vulnerabilities across 286 dependencies.
• Dependabot reconciliation: 294/294 alerts accounted for; 210 patched, 84 removed, 0 unresolved/unknown.
• Full application validation: 158 active Jest suites passed, 411 tests passed, 153 snapshots passed; lint passed with warnings only.
• Production Webpack 5 and Babel build passed.
• Smoke-test TypeScript build passed.
• Final local production image: sha256:5805b34a7c9f6fef7de586509c27cc54f6aac825ba72775defca762d2992a62e.
• Trivy 0.72.0 final-image scan: 0 OS/application vulnerabilities and 0 detected secrets.
• Trivy 0.69.3 source scan (matching the GitHub workflow): 0 vulnerabilities, 0 secrets, and 0 misconfigurations.
• Final GitHub analyses: JavaScript CodeQL 0 results, Actions CodeQL 0 results, and Trivy 0 results; all security gates passed.
• Standalone, worker, and controller Maven profiles completed their non-load-generating compile/JMeter configuration lifecycle in the exact pinned CircleCI image; JMeter 5.6.3 and CASUTG 3.1.1 loaded successfully.
• Runtime smoke: non-root node user; GET /api/cdn/public/ping returned 200 PONG!.
• Direct and staged git diff --check passed; final credential/default/build-argument scan passed.

Deployment and security follow-up

ECR tag 18396 is immutable and remains vulnerable until the merged branch is built and published as a replacement image. I intentionally did not publish a throwaway validation tag because the development repository lifecycle retains only two images and could expire an existing deployment artifact. The exact final image was built, scanned, and runtime-tested locally instead.

Credentials previously committed in configuration, JMeter, or Docker build history must be rotated even though their source defaults are removed here; Git and existing image history remain readable. This includes server API/logging/JWT/integration credentials. Browser-exposed Segment and Filestack keys should be regenerated or tightly origin-restricted as appropriate.

GitHub will close the existing Dependabot and CodeQL alerts after this branch is analyzed and the fixes reach the default branch.