fix(security): bump Docker base to node:22-alpine + wire Snyk to CI

[patrickrb]

Summary

Snyk was reporting 4 critical / 26 high / 17 medium / 42 low = 89 open issues. Investigation found that the SCA scan itself only flags 1 issue (the known leaflet@1.9.4 XSS) — the rest of the count came from snyk container test against node:18-alpine (EOL April 2025), used as the base in both Dockerfile and Dockerfile.dev. Bumping the base image to node:22-alpine (current LTS) clears the bulk in one change.

Changes

• Dockerfile / Dockerfile.dev: node:18-alpine → node:22-alpine
  • Per-image vuln count drops from 58 → 3 (the 3 are bundled npm CVEs in the image's npm 10.x, will resolve as the official image refreshes)
• .github/workflows/ci.yml: setup-node 20 → 22; new security job runs Snyk SCA + container test on PR/push, gates on --severity-threshold=high, and gracefully skips when SNYK_TOKEN is unset (warns in the run log)
• @types/node: ^20 → ^22 to match runtime
• snyk added as devDependency with snyk:test, snyk:test:json, snyk:monitor npm scripts
• .snyk (new): ignore policy for SNYK-JS-LEAFLET-16427276 (XSS, no upstream patch as of 2026-05-10) with 90-day expiry — forces re-evaluation in August

Why a base image bump instead of npm overrides (per #184)

PR #184 (Aug 2025) successfully cleared 15 vulns via direct deps + npm overrides. That pattern was the working hypothesis for this round, but the SCA scan came back with only the leaflet XSS — meaning the 89-count was entirely container-side, not in the package tree. A targeted base image upgrade is far smaller blast radius than another round of overrides.

Follow-up required

Add SNYK_TOKEN to repo secrets (Settings → Secrets and variables → Actions). Until then the security job runs but skips the actual scan steps. Once added, the job enforces high-severity gating automatically. After confirming it works, optionally add security to the tests-required job and to branch protection for hard enforcement.

Test plan

• npm run lint → 0 errors
• npm run build → success
• npm run snyk:test → "no vulnerable paths found" (with .snyk policy applied)
• snyk container test node:22-alpine → 3 issues (down from 58 on node:18-alpine)
• CI: test job passes on Node 22
• CI: security job runs (skipped step warning if SNYK_TOKEN not yet set)
• After adding SNYK_TOKEN: security job actually scans and passes

Related

• fix: resolve 15 Snyk vulnerabilities (1 Critical, 8 High, 6 Medium) #184 — prior Snyk round (npm overrides approach)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nodelog	Ready	Preview, Comment	May 10, 2026 5:08pm