fix(security): bump Docker base to node:22-alpine + wire Snyk to CI

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
 
     - uses: actions/setup-node@v4
       with:
-        node-version: '20'
+        node-version: '22'
         cache: 'npm'
 
     - name: Install dependencies
@@ -43,6 +43,39 @@ jobs:
         path: playwright-report/
         retention-days: 30
 
+  security:
+    runs-on: ubuntu-latest
+    env:
+      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+      - name: Install dependencies
+        run: npm ci
+      - name: Check Snyk token
+        id: snyk_token
+        run: |
+          if [ -n "$SNYK_TOKEN" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::SNYK_TOKEN not set - skipping Snyk scan. Add it to repo secrets to enable enforcement."
+          fi
+      - name: Snyk SCA test
+        if: steps.snyk_token.outputs.present == 'true'
+        uses: snyk/actions/node@master
+        with:
+          args: --severity-threshold=high
+      - name: Snyk container test (Dockerfile)
+        if: steps.snyk_token.outputs.present == 'true'
+        uses: snyk/actions/docker@master
+        with:
+          image: node:22-alpine
+          args: --file=Dockerfile --severity-threshold=high
+
   # This job will be required for merging PRs
   tests-required:
     runs-on: ubuntu-latest

.gitignore

@@ -36,6 +36,11 @@ yarn-error.log*
 # vercel
 .vercel
 
+# snyk
+snyk-report.json
+container-report.json
+.dccache
+
 #claude
 /.claude/
 

.snyk

@@ -0,0 +1,15 @@
+# Snyk (https://snyk.io) policy file
+# Ignored vulnerabilities require a `reason` and an `expires` date so they
+# resurface for re-evaluation. Do not add permanent suppressions.
+version: v1.25.0
+ignore:
+  SNYK-JS-LEAFLET-16427276:
+    - '*':
+        reason: >-
+          leaflet 1.9.4 XSS — no upstream patch available as of 2026-05-10.
+          Tracked at https://security.snyk.io/vuln/SNYK-JS-LEAFLET-16427276.
+          Re-evaluate at expiry: bump if patched, otherwise consider replacing
+          with maplibre-gl-js / openlayers.
+        expires: 2026-08-10
+        created: 2026-05-10
+patch: {}

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:18-alpine AS base
+FROM node:22-alpine AS base
 
 # Install dependencies only when needed
 FROM base AS deps

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM node:18-alpine
+FROM node:22-alpine
 
 # Install dependencies for development including PostgreSQL client
 RUN apk add --no-cache libc6-compat postgresql-client bash