fix(security): resolve all npm audit vulnerabilities (2026-08-24)

[lupita-hom]

Security Scan — 2026-08-24

Client (5 vulnerabilities fixed)

Package	Severity	Issue
@babel/core	low	Arbitrary file read via sourceMappingURL
nanoid	high	Infinite loop with negative/zero size
postcss	high	XSS, path traversal, arbitrary file read
react-router	high	RCE, DoS, CSRF, open redirect, XSS
vite	high	NTLMv2 hash disclosure, fs.deny bypass

Server (4 vulnerabilities fixed)

Package	Severity	Issue
body-parser	moderate	DoS via invalid limit value
esbuild	low	Arbitrary file read on Windows dev server
qs	moderate	DoS via TypeError on null entries
express	moderate	Depends on vulnerable qs

Code Review

Manual review of server routes, auth, CORS, services, and Docker config found no additional issues:

• ✅ OAuth state validation present
• ✅ Auth middleware on all API routes
• ✅ CORS restricted to configured origin
• ✅ Helmet security headers enabled
• ✅ No secrets in code (env-based config)
• ✅ No injection vectors in route params
• ✅ Session cookies: httpOnly + sameSite=lax

All fixes are non-breaking semver updates via npm audit fix.