fix(security): clear vite/vitest/esbuild CVEs and unblock coverage-evidence

.github/workflows/ci.yml

@@ -11,9 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      # pnpm version comes from the package.json "packageManager" field
+      # (pnpm 10+), which is required to read `overrides` from
+      # pnpm-workspace.yaml consistently with the committed lockfile.
       - uses: pnpm/action-setup@v4
-        with:
-          version: 9
       - uses: actions/setup-node@v4
         with:
           node-version: 22

Dockerfile

@@ -1,15 +1,23 @@
 # Multi-stage build for the standalone static demo.
 # Build:  docker build -t cwl-editor-demo .
-# Run:    docker run --rm -p 8080:80 cwl-editor-demo  ->  http://localhost:8080
-FROM node:22-alpine AS build
+# Run:    docker run --rm -p 8080:8080 cwl-editor-demo  ->  http://localhost:8080
+FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2 AS build
 WORKDIR /app
 RUN corepack enable
-COPY package.json pnpm-lock.yaml* ./
-RUN pnpm install --frozen-lockfile || pnpm install
+# pnpm-workspace.yaml carries the security overrides, so it must be present for
+# the frozen install to resolve consistently with the committed lockfile.
+COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml ./
+RUN pnpm install --frozen-lockfile
 COPY . .
 RUN pnpm build:demo
 
-FROM nginx:1.27-alpine AS runtime
-COPY --from=build /app/dist-demo /usr/share/nginx/html
-EXPOSE 80
+FROM nginx:1.27-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10 AS runtime
+# Serve as the image's built-in unprivileged `nginx` user on an unprivileged
+# port so the container never runs as root (satisfies trivy DS-0002).
+COPY --from=build --chown=nginx:nginx /app/dist-demo /usr/share/nginx/html
+RUN sed -i 's/listen       80;/listen       8080;/' /etc/nginx/conf.d/default.conf \
+    && chown -R nginx:nginx /usr/share/nginx/html /var/cache/nginx /var/run /var/log/nginx
+USER nginx
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 CMD wget -qO- http://127.0.0.1:8080/ >/dev/null || exit 1
 CMD ["nginx", "-g", "daemon off;"]

README.md

@@ -133,7 +133,7 @@ pnpm build:demo     # static site -> dist-demo/
 
 ```bash
 docker build -t cwl-editor-demo .
-docker run --rm -p 8080:80 cwl-editor-demo   # http://localhost:8080
+docker run --rm -p 8080:8080 cwl-editor-demo   # http://localhost:8080
 ```
 
 ## Scripts

package.json

@@ -5,6 +5,7 @@
   "license": "MIT",
   "author": "ContextualWisdomLab",
   "type": "module",
+  "packageManager": "pnpm@10.34.4",
   "keywords": [
     "editor",
     "wysiwyg",
@@ -88,17 +89,18 @@
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.2.0",
     "@testing-library/user-event": "^14.5.2",
+    "@types/node": "^22.10.5",
     "@types/react": "^18.3.18",
     "@types/react-dom": "^18.3.5",
     "@types/turndown": "^5.0.5",
     "@vitejs/plugin-react": "^4.3.4",
-    "@vitest/coverage-v8": "^2.1.8",
+    "@vitest/coverage-v8": "^3.2.6",
     "jsdom": "^25.0.1",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "typescript": "^5.7.3",
-    "vite": "^5.4.11",
+    "vite": "^6.4.3",
     "vite-plugin-dts": "^4.5.0",
-    "vitest": "^2.1.8"
+    "vitest": "^3.2.6"
   }
 }