fix: remediate vulnerabilities (#519)

* fix: pin node:24.18.0-alpine to Alpine 3.24.1 to remediate OpenSSL CVEs

Pins both Dockerfiles to node:24.18.0-alpine at the digest that ships
libcrypto3/libssl3 3.5.7-r0, fixing 15 CVEs from the June 9 2026
OpenSSL advisory:
CVE-2026-34180..34183, CVE-2026-42764, CVE-2026-42766..42770,
CVE-2026-45445..45447, CVE-2026-7383, CVE-2026-9076

Ref: https://alpinelinux.org/posts/Alpine-3.24.1-released.html

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix: pin node:24.18.0-alpine to Alpine 3.24.1 to remediate OpenSSL CVEs

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix: upgrade deps to remediate npm audit vulnerabilities

Upgrades to fix 16 moderate/high CVEs:
- better-auth: 1.6.2 → ^1.6.11 (fixes GHSA-cq3f-vc6p-68fh)
- vite: ^8.0.5 → ^8.0.16 (fixes GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3)
- Transitive: undici → 7.28.0, hono → >=4.12.25, qs → >=6.15.2,
  shell-quote → >=1.8.4, js-yaml 3.x → 3.15.0, js-yaml 4.x → 4.3.0

Also migrates pnpm overrides from package.json to pnpm-workspace.yaml,
which is required by pnpm v10.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: kantord

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24-alpine AS base
+FROM node:24.18.0-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd AS base
 
 # Install dependencies only when needed
 FROM base AS deps

dev-auth/Dockerfile

@@ -1,5 +1,5 @@
 # OIDC Mock Provider for Development
-FROM node:24-alpine
+FROM node:24.18.0-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd
 
 WORKDIR /app
 

package.json

@@ -52,7 +52,7 @@
     "ai-sdk-ollama": "^3.0.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
-    "better-auth": "1.6.2",
+    "better-auth": "^1.6.11",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
     "date-fns": "^4.1.0",
@@ -101,7 +101,7 @@
     "tailwindcss": "^4",
     "tsx": "4.21.0",
     "typescript": "^6.0.2",
-    "vite": "^8.0.5",
+    "vite": "^8.0.16",
     "vite-tsconfig-paths": "^6.0.0",
     "vitest": "^4.0.8",
     "vitest-fail-on-console": "^0.10.1"
@@ -110,26 +110,5 @@
     "*.{ts,tsx,js,jsx,json,css}": [
       "biome check --write --no-errors-on-unmatched"
     ]
-  },
-  "pnpm": {
-    "overrides": {
-      "express-rate-limit": ">=8.2.2",
-      "lodash": ">=4.17.23",
-      "lodash-es": ">=4.17.23",
-      "hono": ">=4.12.18",
-      "@hono/node-server": "^1.19.14",
-      "defu": "^6.1.5",
-      "rollup": ">=4.59.0",
-      "undici": "7.24.6",
-      "kysely": ">=0.28.17 <0.29.0",
-      "picomatch": ">=4.0.4",
-      "qs": ">=6.14.2",
-      "yaml": ">=2.8.3",
-      "path-to-regexp@>=8.0.0 <8.4.0": "8.4.0",
-      "path-to-regexp@>=0.1.0 <0.1.13": "0.1.13",
-      "postcss": ">=8.5.10",
-      "fast-uri": ">=3.1.2",
-      "ip-address": ">=10.1.1"
-    }
   }
 }