Security: remediate September 2026 alerts

[jmgasper]

Summary

• move local, build, and production runtimes to Node.js 26.5.1
• pin vulnerable transitive dependency paths to js-yaml 3.15.1, 4.3.1, and 5.2.3 plus deepmerge-ts 8.0.0
• build the production stage from Alpine 3.24 with nodejs-current 26.5.1-r0 dynamically linked to libcrypto3/libssl3 3.5.8-r0
• keep npm and pnpm out of the final image and document the supported runtime
• add regression coverage for the production runtime package contract

Security findings addressed

• Dependabot Initial production deploy #1 and PM-5846: apply database migrations before API startup #2: vulnerable development js-yaml 3.x/4.x paths
• Dependabot PM-5844: Require assignment before support replies #3: vulnerable runtime deepmerge-ts 7.1.5
• Dependabot PM-5858: Require assignment before ticket closure #4: runtime js-yaml remains on patched 5.2.3
• latest dev ECR image findings for Node 22.23.1, bundled OpenSSL 3.5.7, and deepmerge-ts 7.1.5
• GitHub code scanning currently has no analysis/alerts for this repository

Validation

• pnpm lint
• pnpm build
• pnpm test --runInBand (63 tests passed)
• pnpm audit --audit-level=moderate (no known vulnerabilities)
• clean, no-cache Docker build including lint, tests, and build
• production runtime inspection: Alpine 3.24.1, Node 26.5.1, OpenSSL 3.5.8, non-root node user, and no npm/pnpm
• production Prisma schema validation under the final runtime
• Trivy final-image scan: 0 critical/high/medium OS or Node package findings

[jmgasper]

ECR follow-up verification: candidate september2026-security-d644278-inspector (sha256:dba46eeee94182f3d2e12a26ad2eed4797086a2f82eab859a86cd708160f2a87) is Inspector ACTIVE / SUCCESSFUL with zero active critical, high, or medium findings. Deployed tag 11 was not changed.