fix(cd): align Trivy gate + clear every remaining HIGH/CRITICAL

.github/workflows/cd.yml

@@ -119,6 +119,10 @@ jobs:
           severity: HIGH,CRITICAL
           exit-code: "1"
           ignore-unfixed: true
+          # Without this, sarif output makes trivy scan at ALL severities and
+          # the exit code fires on ANY finding — the third v0.1.0 firing
+          # failed the lims image on a MEDIUM despite the H/C-only gate.
+          limit-severities-for-sarif: true
 
       - name: Upload Trivy SARIF
         if: always()

apps/web/Dockerfile

@@ -37,6 +37,15 @@ ENV NODE_ENV=production
 ENV PORT=3012
 ENV HOSTNAME=0.0.0.0
 
+# Release-gate hardening (v0.1.0 Trivy findings):
+# - upgrade the alpine base packages (libssl3/libcrypto3 HIGHs);
+# - remove npm + corepack from the runtime: the standalone server never
+#   installs packages, and npm's BUNDLED node_modules (tar, sigstore,
+#   glob, minimatch, …) carried 16 HIGH/CRITICAL findings of their own.
+RUN apk --no-cache upgrade && \
+    npm uninstall -g corepack || true && \
+    rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /opt/yarn*
+
 # Run as a non-root user.
 RUN addgroup --system --gid 1001 nodejs && \
     adduser --system --uid 1001 nextjs

apps/web/next-env.d.ts

@@ -1,5 +1,6 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
+/// <reference path="./.next/types/routes.d.ts" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/building-your-application/configuring/typescript for more information.
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.