fix(security): patch critical/high CVEs and migrate pnpm settings

Dockerfile

@@ -2,7 +2,7 @@
 # Automatically indexes content to Turso during build
 
 # Build stage
-FROM node:20-slim AS builder
+FROM node:22-slim AS builder
 
 # Build arguments for Turso credentials (required for indexing and pre-rendering)
 ARG TURSO_DB_URL
@@ -15,7 +15,7 @@ RUN corepack enable && corepack prepare pnpm@latest --activate
 WORKDIR /app
 
 # Copy package files
-COPY package.json pnpm-lock.yaml* ./
+COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml ./
 
 # Install dependencies
 RUN pnpm install --no-frozen-lockfile
@@ -34,7 +34,7 @@ RUN pnpm exec tsx scripts/init-db.ts && pnpm exec tsx scripts/index-content.ts
 RUN pnpm build
 
 # Production stage
-FROM node:20-slim AS runtime
+FROM node:22-slim AS runtime
 
 # Install pnpm
 RUN corepack enable && corepack prepare pnpm@latest --activate
@@ -43,7 +43,7 @@ RUN corepack enable && corepack prepare pnpm@latest --activate
 WORKDIR /app
 
 # Copy package files
-COPY package.json pnpm-lock.yaml* ./
+COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml ./
 
 # Install production dependencies only
 RUN pnpm install --prod --no-frozen-lockfile

Dockerfile.local

@@ -1,7 +1,7 @@
 # Dockerfile for local development and testing with embedded SQLite (local.db)
 
 # Build stage
-FROM node:20-slim AS builder
+FROM node:22-slim AS builder
 
 # Install pnpm
 RUN corepack enable && corepack prepare pnpm@latest --activate
@@ -10,7 +10,7 @@ RUN corepack enable && corepack prepare pnpm@latest --activate
 WORKDIR /app
 
 # Copy package files
-COPY package.json pnpm-lock.yaml* ./
+COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml ./
 
 # Install dependencies
 RUN pnpm install --no-frozen-lockfile
@@ -25,7 +25,7 @@ RUN pnpm db:init:local && pnpm index:local
 RUN pnpm build
 
 # Production stage
-FROM node:20-slim AS runtime
+FROM node:22-slim AS runtime
 
 # Install pnpm
 RUN corepack enable && corepack prepare pnpm@latest --activate
@@ -34,7 +34,7 @@ RUN corepack enable && corepack prepare pnpm@latest --activate
 WORKDIR /app
 
 # Copy package files
-COPY package.json pnpm-lock.yaml* ./
+COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml ./
 
 # Install production dependencies only
 RUN pnpm install --prod --no-frozen-lockfile

package.json

@@ -42,7 +42,7 @@
   },
   "dependencies": {
     "@astrojs/node": "^10.0.6",
-    "@astrojs/react": "^5.0.4",
+    "@astrojs/react": "^5.0.7",
     "@libsql/client": "^0.17.3",
     "@logan/libsql-search": "jsr:^0.1.3",
     "@radix-ui/react-dialog": "^1.1.15",
@@ -55,7 +55,7 @@
     "marked": "^18.0.2",
     "react": "^19.2.5",
     "react-dom": "^19.2.5",
-    "sanitize-html": "^2.17.3",
+    "sanitize-html": "^2.17.4",
     "tailwind-merge": "^3.5.0",
     "tailwindcss": "^4.2.4",
     "winston": "^3.19.0"
@@ -69,25 +69,12 @@
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "@types/sanitize-html": "^2.16.1",
-    "@vitest/browser": "^4.1.5",
-    "@vitest/coverage-v8": "^4.1.5",
-    "@vitest/ui": "^4.1.5",
+    "@vitest/browser": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/ui": "^4.1.8",
     "happy-dom": "^20.9.0",
     "tsx": "^4.21.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.5"
-  },
-  "pnpm": {
-    "allowedBuilds": [
-      "sharp",
-      "@xenova/transformers"
-    ],
-    "overrides": {
-      "sharp": "^0.34.4"
-    },
-    "onlyBuiltDependencies": [
-      "sharp",
-      "@xenova/transformers"
-    ]
+    "vitest": "^4.1.8"
   }
 }