Remediate September 2026 security findings

.nvmrc

@@ -1 +1 @@
-26.5.0
+26.5.1

ReadMe.md

@@ -190,6 +190,8 @@ pnpm run test:newman:clear
 
 The Postman entrypoint uses Newman 6 directly and retains the existing token coverage, per-folder execution order, cleanup, and `newman/reports.html` CircleCI artifact. The `html` reporter name selects that local aggregate report; the supported `cli`, `json`, and `junit` reporter names are passed through to Newman.
 
+The exported manual Postman environment intentionally leaves bearer-token values blank. Populate those values only in a local, uncommitted environment before using the collection; never commit live or example JWTs.
+
 CircleCI performs the Docker build and deployment using the existing `APPNAME`, `DEPLOY_ENV`, and parameter-store paths. The automated-test workflow uses Node 26.5.0, pnpm 11.15.1, and the same deployment environment names.
 
 See `Verification.md` for the regression checklist.

app-bootstrap.ts

@@ -3,10 +3,10 @@
  *
  * This module is loaded before controllers and services so their Joi schemas and
  * BigInt values retain the behavior exposed by the original JavaScript runtime.
+ * Node's native Promise remains in place because current HTTP dependencies use
+ * standard methods such as `Promise.withResolvers` that Bluebird does not expose.
  */
 
-global.Promise = require('bluebird')
-
 const config = require('config')
 const Joi = require('joi')
 

docker/Dockerfile

@@ -1,9 +1,8 @@
 # syntax=docker/dockerfile:1
 
-ARG NODE_VERSION=26.5.0
-ARG ALPINE_VERSION=3.23
+ARG NODE_VERSION=26.5.1
 
-FROM node:${NODE_VERSION}-alpine${ALPINE_VERSION} AS build
+FROM node:${NODE_VERSION}-alpine AS build
 
 ARG PNPM_VERSION=11.15.1
 
@@ -30,29 +29,31 @@ RUN mkdir -p src/scripts/seed \
   && pnpm build \
   && pnpm prune --prod
 
-FROM node:${NODE_VERSION}-alpine${ALPINE_VERSION} AS production
+FROM alpine:3.24 AS production
+
+ARG NODE_VERSION
 
 ENV NODE_ENV=production
 WORKDIR /resources-api
 
 RUN apk upgrade --no-cache \
-  && apk add --no-cache bash openssl \
-  && rm -rf /usr/local/lib/node_modules/npm \
-  && rm -f /usr/local/bin/npm /usr/local/bin/npx
-
-COPY --from=build --chown=node:node /resources-api/dist ./dist
-COPY --from=build --chown=node:node /resources-api/node_modules ./node_modules
-COPY --from=build --chown=node:node /resources-api/package.json ./package.json
-COPY --from=build --chown=node:node /resources-api/config ./config
-COPY --from=build --chown=node:node /resources-api/prisma.config.ts ./prisma.config.ts
-COPY --from=build --chown=node:node /resources-api/prisma ./prisma
-COPY --from=build --chown=node:node /resources-api/docs ./docs
-COPY --from=build --chown=node:node /resources-api/packages/resources-prisma-client ./packages/resources-prisma-client
-COPY --from=build --chown=node:node /resources-api/src/generated ./src/generated
-COPY --from=build --chown=node:node /resources-api/src/scripts/seed ./src/scripts/seed
-COPY --from=build --chown=node:node --chmod=755 /resources-api/appStartUp.sh ./appStartUp.sh
-
-USER node
+  && apk add --no-cache bash "nodejs-current=${NODE_VERSION}-r0" \
+  && addgroup -S -g 10001 app \
+  && adduser -S -D -H -u 10001 -G app app
+
+COPY --from=build --chown=app:app /resources-api/dist ./dist
+COPY --from=build --chown=app:app /resources-api/node_modules ./node_modules
+COPY --from=build --chown=app:app /resources-api/package.json ./package.json
+COPY --from=build --chown=app:app /resources-api/config ./config
+COPY --from=build --chown=app:app /resources-api/prisma.config.ts ./prisma.config.ts
+COPY --from=build --chown=app:app /resources-api/prisma ./prisma
+COPY --from=build --chown=app:app /resources-api/docs ./docs
+COPY --from=build --chown=app:app /resources-api/packages/resources-prisma-client ./packages/resources-prisma-client
+COPY --from=build --chown=app:app /resources-api/src/generated ./src/generated
+COPY --from=build --chown=app:app /resources-api/src/scripts/seed ./src/scripts/seed
+COPY --from=build --chown=app:app --chmod=755 /resources-api/appStartUp.sh ./appStartUp.sh
+
+USER app
 EXPOSE 3000
 
 CMD ["./appStartUp.sh"]

docs/topcoder-challenge-resource-api.postman_environment.json

@@ -19,22 +19,22 @@
 		},
 		{
 			"key": "user1_token",
-			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6WyJUb3Bjb2RlciBVc2VyIl0sImlzcyI6Imh0dHBzOi8vYXBpLnRvcGNvZGVyLWRldi5jb20iLCJoYW5kbGUiOiJkZW5pcyIsImV4cCI6MTY4MjgwMDE2OSwidXNlcklkIjoiMjUxMjgwIiwiaWF0IjoxNTQ5Nzk5NTY5LCJlbWFpbCI6ImVtYWlsQGRvbWFpbi5jb20ueiIsImp0aSI6IjljNDUxMWM1LWMxNjUtNGExYi04OTllLWI2NWFkMGUwMmI1NSJ9.BCF6xW3aQfHDDFbgGvvOKzvwEXVLWGf-TgF5JrtM9Tg",
+			"value": "",
 			"enabled": true
 		},
 		{
 			"key": "user2_token",
-			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6WyJUb3Bjb2RlciBVc2VyIiwiY29waWxvdCJdLCJpc3MiOiJodHRwczovL2FwaS50b3Bjb2Rlci1kZXYuY29tIiwiaGFuZGxlIjoiaG9ob3NreSIsImV4cCI6MTY4MTc5MjM3MCwidXNlcklkIjoiMTYwOTY4MjMiLCJpYXQiOjE1NDk3OTE3NzAsImVtYWlsIjoiZW1haWxAZG9tYWluLmNvbS56IiwianRpIjoiZjFlNjEzYmUtZDViOS00MjMxLWJhYWUtZWU5ZjJkMjI3MjM0In0.YfzhT9rLFK6U2suPdiCSx_n7Ce6ZIt_oLZ0BcvfMqAk",
+			"value": "",
 			"enabled": true
 		},
 		{
 			"key": "admin_token",
-			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6WyJUb3Bjb2RlciBVc2VyIiwiQ29ubmVjdCBTdXBwb3J0IiwiYWRtaW5pc3RyYXRvciIsInRlc3RSb2xlIiwiYWFhIiwidG9ueV90ZXN0XzEiLCJDb25uZWN0IE1hbmFnZXIiLCJDb25uZWN0IEFkbWluIiwiY29waWxvdCIsIkNvbm5lY3QgQ29waWxvdCBNYW5hZ2VyIl0sImlzcyI6Imh0dHBzOi8vYXBpLnRvcGNvZGVyLWRldi5jb20iLCJoYW5kbGUiOiJUb255SiIsImV4cCI6MTY4MTA1MjIxMSwidXNlcklkIjoiODU0Nzg5OSIsImlhdCI6MTU0OTc5MTYxMSwiZW1haWwiOiJ0amVmdHMrZml4QHRvcGNvZGVyLmNvbSIsImp0aSI6ImY5NGQxZTI2LTNkMGUtNDZjYS04MTE1LTg3NTQ1NDRhMDhmMSJ9.ONh2RSE5NeJzyjBD68TSUdNFMs5v5BXtga4LchR2x3s",
+			"value": "",
 			"enabled": true
 		},
 		{
 			"key": "m2m_all_token",
-			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE2ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJhbGw6cmVzb3VyY2VzIGFsbDpyZXNvdXJjZV9yb2xlcyIsImd0eSI6ImNsaWVudC1jcmVkZW50aWFscyJ9.UhuqMGrrNzj-VQz2-BogN28YZTE9uauIfdP7EOhrKB0",
+			"value": "",
 			"enabled": true
 		},
 		{
@@ -54,17 +54,17 @@
 		},
 		{
 			"key": "expire_token",
-			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6WyJUb3Bjb2RlciBVc2VyIiwiQ29ubmVjdCBTdXBwb3J0IiwiYWRtaW5pc3RyYXRvciIsInRlc3RSb2xlIiwiYWFhIiwidG9ueV90ZXN0XzEiLCJDb25uZWN0IE1hbmFnZXIiLCJDb25uZWN0IEFkbWluIiwiY29waWxvdCIsIkNvbm5lY3QgQ29waWxvdCBNYW5hZ2VyIl0sImlzcyI6Imh0dHBzOi8vYXBpLnRvcGNvZGVyLWRldi5jb20iLCJoYW5kbGUiOiJUb255SiIsImV4cCI6MTU1MTA2MzIxMSwidXNlcklkIjoiODU0Nzg5OSIsImlhdCI6MTU1MTA1MzIxMSwiZW1haWwiOiJ0amVmdHMrZml4QHRvcGNvZGVyLmNvbSIsImp0aSI6ImY5NGQxZTI2LTNkMGUtNDZjYS04MTE1LTg3NTQ1NDRhMDhmMSJ9.97-pjuSGGqDAqK2FG2yi_3nmzB7ZMXQwtG0bi8_PlKk",
+			"value": "",
 			"enabled": true
 		},
 		{
 			"key": "m2m_read_token",
-			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE2ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJyZWFkOnJlc291cmNlcyIsImd0eSI6ImNsaWVudC1jcmVkZW50aWFscyJ9.1EdekIx1jU2lDSIXlMFCPmXkzLWQ_ZvxPuutQWuTKu0",
+			"value": "",
 			"enabled": true
 		},
 		{
 			"key": "m2m_modify_token",
-			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGNvZGVyLWRldi5hdXRoMC5jb20vIiwic3ViIjoiZW5qdzE4MTBlRHozWFR3U08yUm4yWTljUVRyc3BuM0JAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vbTJtLnRvcGNvZGVyLWRldi5jb20vIiwiaWF0IjoxNTUwOTA2Mzg4LCJleHAiOjE2ODA5OTI3ODgsImF6cCI6ImVuancxODEwZUR6M1hUd1NPMlJuMlk5Y1FUcnNwbjNCIiwic2NvcGUiOiJjcmVhdGU6cmVzb3VyY2VzIGRlbGV0ZTpyZXNvdXJjZXMgdXBkYXRlOnJlc291cmNlcyIsImd0eSI6ImNsaWVudC1jcmVkZW50aWFscyJ9.f_3FLT3jMTnKwGIg8fcFP2lmShy5S9d5IvLNbXSj2Eo",
+			"value": "",
 			"enabled": true
 		},
 		{
@@ -84,7 +84,7 @@
 		},
 		{
 			"key": "user3_token",
-			"value": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6WyJUb3Bjb2RlciBVc2VyIl0sImlzcyI6Imh0dHBzOi8vYXBpLnRvcGNvZGVyLWRldi5jb20iLCJoYW5kbGUiOiJsYXJzMjUyMCIsImV4cCI6MTY4MjgwMDE2OSwidXNlcklkIjoiMjg3MTMxIiwiaWF0IjoxNTQ5Nzk5NTY5LCJlbWFpbCI6ImVtYWlsQGRvbWFpbi5jb20ueiIsImp0aSI6IjljNDUxMWM1LWMxNjUtNGExYi04OTllLWI2NWFkMGUwMmI1NSJ9.QIXF4-qSkH7n-i0_4mzF3peFTZ5PjaSYHjm9EjhTfS4",
+			"value": "",
 			"enabled": true
 		},
 		{
@@ -118,4 +118,4 @@
 	"_postman_variable_scope": "environment",
 	"_postman_exported_at": "2020-03-20T09:04:47.996Z",
 	"_postman_exported_using": "Postman/7.13.0"
-}
+}

migrator/package.json

@@ -18,5 +18,9 @@
   },
   "devDependencies": {
     "jest": "^29.7.0"
+  },
+  "overrides": {
+    "brace-expansion": "1.1.18",
+    "js-yaml": "3.15.1"
   }
 }

package.json

@@ -22,7 +22,7 @@
     "view-data": "node dist/src/scripts/view-data.js",
     "mock-api": "NODE_ENV=test node --require ts-node/register/transpile-only mock/mock-api.js",
     "mock-challenge-api": "NODE_ENV=test node --require ts-node/register/transpile-only mock/mock-challenge-api.js",
-    "test": "nyc --reporter=html --reporter=text mocha --require ts-node/register/transpile-only test/unit/logger.test.ts test/unit/prisma-adapter.test.ts test/unit/test.js --require test/common/prepare.js --timeout 60000 --exit",
+    "test": "nyc --reporter=html --reporter=text mocha --require ts-node/register/transpile-only test/unit/logger.test.ts test/unit/outbound-url.test.ts test/unit/prisma-adapter.test.ts test/unit/test.js --require test/common/prepare.js --timeout 60000 --exit",
     "test:logger": "mocha --require ts-node/register/transpile-only test/unit/logger.test.ts --timeout 10000",
     "test:adapter": "mocha --require ts-node/register/transpile-only test/unit/prisma-adapter.test.ts",
     "test:newman": "NODE_ENV=test node --require ts-node/register/transpile-only test/postman/newman.js",
@@ -58,7 +58,6 @@
     "@nestjs/platform-express": "^11.1.8",
     "@prisma/adapter-pg": "7.8.0",
     "@prisma/client": "7.8.0",
-    "bluebird": "^3.5.1",
     "body-parser": "1.20.6",
     "config": "^3.0.1",
     "cors": "^2.7.1",
@@ -99,6 +98,6 @@
     ]
   },
   "volta": {
-    "node": "26.5.0"
+    "node": "26.5.1"
   }
 }