fix(security): CVE and Scorecard alert remediation

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     services:
       postgres:
-        image: postgres:16-alpine
+        image: postgres:16-alpine@sha256:cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres
@@ -63,7 +63,7 @@ jobs:
     needs: verify
     services:
       postgres:
-        image: postgres:16-alpine
+        image: postgres:16-alpine@sha256:cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres

.github/workflows/codeql.yml

@@ -12,6 +12,9 @@ concurrency:
   group: codeql-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -6,7 +6,6 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 concurrency:
   group: release-${{ github.event.release.tag_name }}
@@ -15,6 +14,9 @@ concurrency:
 jobs:
   publish-docker:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

.github/workflows/screenshots.yml

@@ -24,7 +24,7 @@ jobs:
 
     services:
       postgres:
-        image: postgres:16-alpine
+        image: postgres:16-alpine@sha256:cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- Override transitive Dependabot CVEs: mysql2 3.24.3, hono 4.12.34, @hono/node-server 1.19.17, fast-uri 3.1.7, browserslist 4.28.9, brace-expansion 1.1.18 / 5.0.9.
+- Pin `node:22-alpine` and `postgres:16-alpine` images to registry digests.
+- Least-privilege GitHub token permissions: CodeQL defaults to `contents: read` with `security-events: write` on the analyze job; Release grants `packages: write` only on the publish job.
+
 ### Changed
 
 - Bump safe npm patch/minor dependencies (Next.js 16.3.4, Auth.js, Playwright, hook-form, lucide-react, TanStack Query, Zod, TypeScript types, tsx). Prisma stays on 7.8.x; `pg` remains pinned below 8.19. Vitest stays on 4.1.9 (npm arborist peer crash on 4.1.11).

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-alpine AS base
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS base
 RUN apk add --no-cache libc6-compat
 
 FROM base AS deps

docker-compose.stack.yml

@@ -6,7 +6,7 @@
 
 services:
   postgres:
-    image: postgres:16-alpine
+    image: postgres:16-alpine@sha256:cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685
     restart: unless-stopped
     environment:
       POSTGRES_USER: postgres

docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   postgres:
-    image: postgres:16-alpine
+    image: postgres:16-alpine@sha256:cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685
     restart: unless-stopped
     environment:
       POSTGRES_USER: postgres

package.json

@@ -84,5 +84,14 @@
     "tsx": "^4.23.13",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9"
+  },
+  "overrides": {
+    "mysql2": "3.24.3",
+    "hono": "4.12.34",
+    "@hono/node-server": "1.19.17",
+    "fast-uri": "3.1.7",
+    "browserslist": "4.28.9",
+    "brace-expansion@1": "1.1.18",
+    "brace-expansion@5": "5.0.9"
   }
 }