[jmgasper]

The ECS API image included the legacy frontend dependency tree on Node.js 16, and the root/workspace audit still reported critical, high and medium findings. This separates the API production dependencies into a non-root Alpine/Node.js 26 image and refreshes the frontend and development tools. The root/workspace audit and final API image scan now have zero findings at those severities.

The API uses the maintained Cypress Request fork, Nodemailer 10/AWS SDK v3 SES, current Swagger UI and corrected Passport session callbacks. The learning client retains React 16 while moving to Gatsby 4.25.9, patched Webpack/PostCSS and Storybook 8.6.19. The separate challenge editor uses React 18, React Router 7 and Vite 8, retaining its existing commands, API setting, port and build output.

Narrow compatibility adapters preserve UUID, glob, file detection, proxy and URI-decoding interfaces. Parcel components and the native LMDB cache use aligned versions. Gatsby's SSR bundle preserves mutable DEBUG handling; the editor deduplicates React and supplies CodeMirror's expected browser global. TypeScript checks the editor separately, and generated bundles are excluded from source checks. A new CI audit gate rejects critical/high/medium dependency findings. Cypress 16 uses public configuration exposure and allowlisted Node seed tasks; each test gets a fresh login where the removed cookie-preservation API was used. Browser CI explicitly installs the matching Cypress binary and uses the current GitHub action.

Validation:

• Clean npm ci including install scripts passes. Root/workspace npm audit: 0 critical, 0 high, 0 moderate, 27 low. No vulnerabilities are ignored by the audit gate.
• API Docker build passes; Trivy reports zero critical/high/medium OS or Node.js findings. The final image runs as UID 10001 against isolated MongoDB: health 200, protected unauthenticated route 403, model create/read/delete passes.
• All 10 API security tests and all 3 frontend adapter tests pass. These cover real SMTP, SES MIME/error handling, redirects/forms, Swagger routes, OAuth session regeneration, file detection, a real local proxy request and malformed URI decoding.
• Gatsby production build generates all 2,802 pages. Worker compilation, Storybook production build, Vite editor build, full JavaScript/TypeScript lint and Prettier checks pass.
• Cypress 16 verifies and runs two isolated Electron smoke checks, including a built challenge with the real support file. The seed-task test checks all five fixture modes and rejects arbitrary commands. GitHub browser CI now installs Cypress and reaches tests. The authenticated Electron suite stops at the existing development-login mismatch: the mock issues a legacy wrapped access token without the exp/sub claims required by the unchanged Topcoder authorization code, so the page never shows “Welcome back”. Chrome and Firefox each finish with 31 passed, 75 failed and 59 skipped tests across 43 specs. Failures include that login mismatch, the documented null curriculum query, and page-content/selector expectations. The full end-to-end suite is not green.
• Chromium loads and hydrates classic and video challenges with no JavaScript errors or failed local assets. A separate browser fixture navigates through the editor, renders CodeMirror, edits a challenge and saves it through an intercepted local API.

Known baseline limitations: the broader Jest suite has 828 passing tests and 42 failures across 8 suites for existing cookie-contract, curriculum-count, layout and snapshot expectations; this PR does not claim a green full suite. The unchanged /learn/ query requires superOrder/order/challengeOrder all zero, but the fork's QA curriculum occupies superOrder zero and starts at order 19, leaving that query empty. Individual challenge routes work. Search, telemetry and video-provider integration were not validated against external services. Low-severity audit findings remain outside the requested scope.

The new audit covers the root lockfile and its workspaces; the final image scan covers the ECS API artifact. See docker/api/README.md and tools/legacy-compat/README.md for maintenance commands and compatibility details. No merge, deployment, shared-database access or production email was performed.