* security(deps): resolve high-severity npm audit advisories via minimatch override
All 9 high-severity advisories stemmed from a single transitive chain:
eslint/eslint-config-next tooling depend on a vulnerable minimatch
(<=10.0.2) that pulls in brace-expansion <=5.0.7 (GHSA-mh99-v99m-4gvg,
DoS via unbounded expansion). These are dev/build-time only packages,
not shipped in the runtime image.
Bumping eslint itself would require a semver-major jump (9.x -> 10.x).
Instead, pin minimatch to ^10.0.3 via package.json overrides, which
drops the vulnerable brace-expansion dependency entirely (newer
minimatch uses @isaacs/brace-expansion). Verified npm audit reports 0
vulnerabilities and both npm run lint and npm run build still pass.
* ci(app): add non-blocking npm audit step to lint-and-build job
Surface high-severity advisories in CI logs without gating merges on
build-time dev-dependency findings a solo dev can triage async.
---------
Co-authored-by: James Maes <jmaes@dmdbrands.com>
Add a Trivy job to the Docker build workflow that scans the built image
for CRITICAL/HIGH CVEs, uploads SARIF to GitHub code scanning, and fails
only on CRITICAL findings so a solo maintainer isn't blocked by HIGH-only
noise. Split top-level workflow permissions down to contents:read and
elevate packages:write / security-events:write per job instead of at the
workflow level. Strip npm/npx/yarn/corepack from the Docker runtime stage
since they are never invoked at runtime (node server.js only) and were
the source of the only CRITICAL/HIGH findings in the current image.
Co-authored-by: James Maes <jmaes@dmdbrands.com>
dependabot[bot]
james.maesandJames Maes