security: remediate exact-head Node dependency vulnerabilities

[seonghobae]

Current candidate evidence — 2026-09-08

Exact PR head 93aaea58815e22ea227f260442fb08f73cad24d4 carries the direct source repairs plus semver-compatible lock refreshes.

• backend clean lock install and all six contract tests: GREEN;
• frontend clean lock install and production build: GREEN;
• frontend production npm audit: 0 vulnerabilities;
• backend production npm audit: 3 HIGH nodes, all one owner chain: prisma@6.19.3 → @prisma/config@6.19.3 → deepmerge-ts@7.1.5;
• compatible refreshes integrated: undici 7.29.1, brace-expansion 5.0.9, body-parser 2.3.0, qs 6.16.0, and react-router(-dom) 7.18.3;
• exact-head SAST run 34195231667, OSV job 101967056510, and Scorecard job 101967056544: GREEN;
• exact-head Security run 34195231651, Trivy job 101967056550: RED with one HIGH CVE-2026-40345 finding at backend/package-lock.json:2040 for deepmerge-ts;
• the same Security run's Dependency Review job 101967056587: HTTP 403 for exact base fea4e4406c975b93d21a794c097e46fe56149989 and head 93aaea58815e22ea227f260442fb08f73cad24d4, before analysis; missing evidence remains fail-closed.

npm's automated proposal is an out-of-range Prisma downgrade; the current stable owner line requires a major migration. Neither is accepted without Prisma schema/migration/generation/build/runtime compatibility evidence. Fresh hosted exact-head results supersede all predecessor scans.

Problem

PR #3 predecessor head ed9248ec874bfba824275cdf47ef9afc7ebe7872 exposed actionable commercial-intake failures. Commit a7737433b9bb65bff167d5e6e26d3fb83578b86b directly repairs the two non-root container findings and the AES-GCM authentication-tag finding with RED→GREEN regression evidence. Vulnerable locked dependencies remain unresolved and require canonical owner repair.

Exact predecessor evidence

• Trivy run 34070587011, job 101593483397: HIGH/MEDIUM findings in brace-expansion, deepmerge-ts, qs, undici, and react-router; the same job also reported the two now-repaired Docker non-root findings.
• Dependency Review job 101593483396: HTTP 403 before analysis for exact base/head; this is missing evidence, not a pass.
• CodeQL job 101593383139: dispatch succeeded with VERDICT_STATE=pending; this is a central receipt state, not source success.

Owner repair contract

1. Reproduce the current locked dependency graph and map each advisory to direct/transitive owner, reachable runtime/build/test surface, fixed version and compatibility boundary.
2. Upgrade, replace or remove vulnerable packages at the canonical package owner; refresh both lockfiles atomically and preserve executable behavior.
3. Add focused RED/GREEN regression or contract evidence for any behavior affected by a major-version transition.
4. Do not close through advisory suppression, scan exclusion, severity downgrade, or mutable dependency URLs.
5. Obtain one unchanged exact head with backend/frontend builds, contracts, Semgrep, Trivy, OSV, Dependency Review, CodeQL, SBOM/provenance and independent review GREEN.

Completion

Close only after protected-branch integration or a verified successor fully carries the dependency, documentation, provenance and regression deltas.