fix(security): bump Docker base image to node:22-alpine + wire Snyk (#186)

The 89 issues Snyk reported (4C/26H/17M/42L) were almost entirely from
node:18-alpine (Node 18 EOL'd 2025-04). Both Dockerfiles bumped to
node:22-alpine drops per-image vuln count from 58 to 3.

- Dockerfile / Dockerfile.dev: node:18-alpine -> node:22-alpine
- CI: setup-node 20 -> 22; new `security` job runs Snyk SCA + container
  test on PR/push, gracefully skips when SNYK_TOKEN is unset
- @types/node ^20 -> ^22 to match runtime
- Add snyk as devDependency with snyk:test/snyk:test:json/snyk:monitor
  scripts
- New .snyk policy ignores SNYK-JS-LEAFLET-16427276 (XSS, no upstream
  patch as of 2026-05-10) with 90-day expiry

Verified: npm run lint (0 errors), npm run build (success), npm run
snyk:test (0 vulnerable paths). The original plan to override transitive
npm deps was scrapped after discovering the SCA scan itself only finds
the leaflet XSS - the dashboard count came from container scans of the
EOL Node 18 base image.

Follow-up: add SNYK_TOKEN to repo secrets to activate CI enforcement.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: patrickrb

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
 
     - uses: actions/setup-node@v4
       with:
-        node-version: '20'
+        node-version: '22'
         cache: 'npm'
 
     - name: Install dependencies
@@ -43,6 +43,39 @@ jobs:
         path: playwright-report/
         retention-days: 30
 
+  security:
+    runs-on: ubuntu-latest
+    env:
+      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+      - name: Install dependencies
+        run: npm ci
+      - name: Check Snyk token
+        id: snyk_token
+        run: |
+          if [ -n "$SNYK_TOKEN" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::SNYK_TOKEN not set - skipping Snyk scan. Add it to repo secrets to enable enforcement."
+          fi
+      - name: Snyk SCA test
+        if: steps.snyk_token.outputs.present == 'true'
+        uses: snyk/actions/node@master
+        with:
+          args: --severity-threshold=high
+      - name: Snyk container test (Dockerfile)
+        if: steps.snyk_token.outputs.present == 'true'
+        uses: snyk/actions/docker@master
+        with:
+          image: node:22-alpine
+          args: --file=Dockerfile --severity-threshold=high
+
   # This job will be required for merging PRs
   tests-required:
     runs-on: ubuntu-latest

.gitignore

@@ -36,6 +36,11 @@ yarn-error.log*
 # vercel
 .vercel
 
+# snyk
+snyk-report.json
+container-report.json
+.dccache
+
 #claude
 /.claude/
 

.snyk

@@ -0,0 +1,15 @@
+# Snyk (https://snyk.io) policy file
+# Ignored vulnerabilities require a `reason` and an `expires` date so they
+# resurface for re-evaluation. Do not add permanent suppressions.
+version: v1.25.0
+ignore:
+  SNYK-JS-LEAFLET-16427276:
+    - '*':
+        reason: >-
+          leaflet 1.9.4 XSS — no upstream patch available as of 2026-05-10.
+          Tracked at https://security.snyk.io/vuln/SNYK-JS-LEAFLET-16427276.
+          Re-evaluate at expiry: bump if patched, otherwise consider replacing
+          with maplibre-gl-js / openlayers.
+        expires: 2026-08-10
+        created: 2026-05-10
+patch: {}

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:18-alpine AS base
+FROM node:22-alpine AS base
 
 # Install dependencies only when needed
 FROM base AS deps

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM node:18-alpine
+FROM node:22-alpine
 
 # Install dependencies for development including PostgreSQL client
 RUN apk add --no-cache libc6-compat postgresql-client bash