chore(deps): patch image and transitive deps

CHANGELOG.md

@@ -6,6 +6,10 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+### Security
+
+- **The image is rebuilt on current Debian bookworm packages.** It picks up the fixed `perl-base`, `libpcre2-8-0` and `openssl` builds that Trivy flagged, including three critical Perl advisories; none of these are reached by the gateway itself, but they ship in the image. The bundled npm moves to 12.2.0, and the gateway's own `ip-address` and `fast-uri` move to 10.7.3 and 3.1.8.
+
 ### Fixed
 
 - **The bundled compose file and the Dokploy, Coolify and Portainer snippets pull the image on every deploy.** Without `pull_policy: always` a platform that redeploys with `docker compose up` kept starting the image it had already cached, so pointing at the `latest` tag never actually updated anything. Automatic restarts are unaffected; only a deliberate deploy talks to the registry. The local build stack overrides the policy so it still builds instead of looking for `junctio:local` on a registry.

Dockerfile

@@ -1,7 +1,7 @@
 ARG BUN_VERSION=1.4.2
 ARG NODE_VERSION=22
 ARG UV_VERSION=0.12.15
-ARG NPM_VERSION=12.0.2
+ARG NPM_VERSION=12.2.0
 
 FROM oven/bun:${BUN_VERSION}-slim AS bun
 FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv

apps/web/package.json

@@ -14,7 +14,7 @@
     "@junctio/schema": "workspace:*",
     "@lucide/vue": "^1.46.0",
     "@tailwindcss/vite": "^4.3.3",
-    "@vueuse/core": "^14.4.0",
+    "@vueuse/core": "^15.0.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "reka-ui": "^2.10.4",

package.json

@@ -24,7 +24,7 @@
     "format": "biome check --write"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.13",
+    "@biomejs/biome": "2.5.14",
     "typescript": "^5.9.3"
   }
 }