Update Alpine OpenSSL and brace-expansion to address CVEs

[Copilot]

Security scans identified vulnerable Alpine OpenSSL packages (libcrypto3, libssl3 @ 3.5.0-r0) and Node.js brace-expansion (1.1.12) requiring updates to patched versions.

Changes

Dockerfile

• Updated base-prod stage from node:23-alpine to node:24-alpine
  • Upgrades Alpine 3.22.0 → 3.22.2
  • Resolves libcrypto3 and libssl3 to 3.5.4-r0

package.json

• Added npm overrides to force brace-expansion@^2.0.2 across all transitive dependencies
• Eliminates vulnerable 1.1.12 version inherited from eslint → minimatch chain

package-lock.json

• Regenerated with overrides applied
• All brace-expansion instances now resolve to 2.0.2

Technical Notes

Node.js 24 is the current LTS (vs 23 development branch) and ships with newer Alpine base containing patched OpenSSL. Using npm overrides allows immediate mitigation without waiting for upstream dependency updates.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Security Vulnerability: Outdated Alpine Dependencies</issue_title>
<issue_description>Our security scans have identified several vulnerable Alpine dependencies in the current version of the project. We would appreciate it if these could be updated to their fixed versions to remediate the security findings.

Vulnerable Dependencies:

1. libcrypto3:
   Current Version:3.5.0-r0
   Expected Fixed Version:3.5.4-r0

2. libssl3:
   Current Version:3.5.0-r0
   Expected Fixed Version:3.5.4-r0

3. brace-expansion:
   Current Version:2.0.1
   Expected Fixed Version:2.0.2

We request that the project's dependencies be updated to the new versions listed above to resolve these security vulnerabilities. Please let us know if a new version with these fixes will be available.
</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Security Vulnerability: Outdated Alpine Dependencies #279

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.