[jmgasper]

Patch application and container dependencies, including Prisma 7.10.1, the immutable reviewed core-library revision, and legacy minimatch consumers. Pin all four external generated clients to reviewed commits so Docker builds no longer follow moving repository HEADs. Keep their runtime dependencies resolvable in both build and production stages.

Adapt the Vanilla MySQL query wrapper to the patched driver's typed values and correct the stale Challenge API test mock to use the current M2M factory. Other source changes are lint formatting or redundant assertion removal.

Validation:

• Full audit: zero critical/high/medium, one low; all 30 original target Dependabot findings patched or removed.
• Final production image: zero critical/high/medium Trivy findings.
• Docker lint/build, 191 unit tests and 2 matcher tests pass. All 13 PostgreSQL integration tests pass with UTC, covering public access boundaries, import provenance, moderation and watch persistence.
• Fresh database migrations, final-image health/readiness and public reads pass. Invalid and expired JWTs return 401; a valid user token succeeds. Runtime is Node 26.12.1 / UID 10001.

The PostgreSQL fixture uses the existing forums search-path setting. Timestamp integration tests must run in UTC, as documented. No deployment or production data changes.