Fix security vulnerabilities detected by Trivy

- CVE-2025-64756: glob CLI command injection - added override to use glob ^11.1.0
- CVE-2025-13466: body-parser DoS - added override to use body-parser ^2.2.1
- CVE-2025-64718: js-yaml prototype pollution - updated to js-yaml ^4.1.1
- BusyBox vulnerabilities (netstat, tar) - added apk upgrade to all Dockerfiles

Changes:
- backend/package.json: Updated js-yaml, added overrides for glob, body-parser
- frontend/package.json: Added overrides for glob, js-yaml
- All Dockerfiles: Added 'apk upgrade --no-cache' to get latest security patches
- backend/Dockerfile.dev: Updated from node:18-alpine to node:20-alpine

backend/Dockerfile

@@ -27,6 +27,9 @@ FROM node:20-alpine
 
 WORKDIR /app
 
+# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
+RUN apk upgrade --no-cache
+
 # Install dumb-init for proper signal handling and postgresql-client for database checks
 RUN apk add --no-cache dumb-init postgresql-client
 

backend/Dockerfile.dev

@@ -1,7 +1,10 @@
-FROM node:18-alpine
+FROM node:20-alpine
 
 WORKDIR /app
 
+# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
+RUN apk upgrade --no-cache
+
 # Install dumb-init for proper signal handling
 RUN apk add --no-cache dumb-init
 

backend/package.json

@@ -33,7 +33,7 @@
     "i18next-browser-languagedetector": "^8.2.0",
     "i18next-http-backend": "^3.0.2",
     "joi": "^17.9.1",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.1.1",
     "jsonwebtoken": "^9.0.0",
     "knex": "^2.4.2",
     "mime-types": "^3.0.1",
@@ -59,6 +59,9 @@
   "overrides": {
     "prebuild-install": {
       "tar-fs": "2.1.4"
-    }
+    },
+    "glob": "^11.1.0",
+    "body-parser": "^2.2.1",
+    "js-yaml": "^4.1.1"
   }
 }

frontend/Dockerfile

@@ -30,6 +30,9 @@ RUN npm run build
 # Production stage
 FROM nginx:alpine
 
+# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
+RUN apk upgrade --no-cache
+
 # Install runtime dependencies
 RUN apk add --no-cache curl
 

frontend/Dockerfile.dev

@@ -3,6 +3,9 @@ FROM node:20-alpine
 
 WORKDIR /app
 
+# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
+RUN apk upgrade --no-cache
+
 # Copy package files
 COPY package*.json ./
 

frontend/Dockerfile.prod

@@ -25,6 +25,9 @@ RUN npm run build
 # Production stage
 FROM nginx:alpine
 
+# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
+RUN apk upgrade --no-cache
+
 # Install runtime dependencies
 RUN apk add --no-cache curl
 

frontend/package.json

@@ -65,5 +65,9 @@
   },
   "optionalDependencies": {
     "@rollup/rollup-linux-x64-gnu": "^4.45.1"
+  },
+  "overrides": {
+    "glob": "^11.1.0",
+    "js-yaml": "^4.1.1"
   }
 }