fix(security): close the 20 high dependency CVEs, and unbreak the gates that were hiding behind them

.github/ISSUE_TEMPLATE/todo-media-storage.md

@@ -40,7 +40,7 @@ Integrate MinIO (or Nhost Storage) for handling file uploads including avatars,
    ```yaml
    # docker-compose.yml
    minio:
-     image: minio/minio:latest
+     image: quay.io/minio/minio:latest
      ports:
        - '9000:9000'
        - '9001:9001'

.github/deploy/docker/docker-compose.production.yml

@@ -254,7 +254,7 @@ services:
   # MinIO Storage (Production)
   # --------------------------------------------------------------------------
   storage:
-    image: minio/minio:latest
+    image: quay.io/minio/minio:latest
     container_name: nchat-storage
     restart: unless-stopped
     environment:

.github/deploy/docker/docker-compose.staging.yml

@@ -168,7 +168,7 @@ services:
   # MinIO Storage (S3-compatible)
   # --------------------------------------------------------------------------
   storage:
-    image: minio/minio:latest
+    image: quay.io/minio/minio:latest
     container_name: nchat-storage-staging
     restart: unless-stopped
     ports:

.github/deploy/docker/docker-compose.yml

@@ -138,7 +138,7 @@ services:
   # MinIO Storage (S3-compatible)
   # --------------------------------------------------------------------------
   storage:
-    image: minio/minio:latest
+    image: quay.io/minio/minio:latest
     container_name: nchat-storage
     restart: unless-stopped
     ports:

.github/deploy/k8s/minio-deployment.yaml

@@ -51,7 +51,7 @@ spec:
     spec:
       containers:
         - name: minio
-          image: minio/minio:latest
+          image: quay.io/minio/minio:latest
           imagePullPolicy: IfNotPresent
           ports:
             - name: api

.github/wiki/nself-cli/Services.md

@@ -1204,7 +1204,7 @@ Enable these services via environment variables in `.backend/.env`.
 
 | Property         | Value                 |
 | ---------------- | --------------------- |
-| **Image**        | `minio/minio:latest`  |
+| **Image**        | `quay.io/minio/minio:latest`  |
 | **API Port**     | 9000                  |
 | **Console Port** | 9001                  |
 | **Console URL**  | http://localhost:9001 |

.github/workflows/hygiene.yml

@@ -280,12 +280,40 @@ jobs:
             exit 0
           fi
 
+          # backend/docker-compose.yml is DELIBERATELY tracked, for CI E2E
+          # provisioning — `nself start --skip-build` needs it present at
+          # checkout. The Doc-Sync step above already carves it out by name and
+          # points at .github/wiki/E2E-Backend-Setup.md; this step did not, so
+          # the two gates contradicted each other: one declared the file
+          # legitimately tracked, the other refused every commit that touched
+          # it. The file could be kept but never corrected, which is how it sat
+          # on a MinIO image that Docker Hub had deleted.
+          #
+          # The carve-out is VERIFIED, not blanket. This gate exists to stop
+          # generated files carrying plaintext credentials into a public repo
+          # (the ntask incident: a generated compose with the postgres password,
+          # Hasura admin secret and JWT keys). That protection is what the
+          # secret check below preserves: every credential-shaped key in this
+          # file must be a ${...} reference, never a literal. A literal value
+          # fails the gate exactly as before, so nothing this gate was built to
+          # catch gets through.
+          ALLOWED_TRACKED_GENERATED='backend/docker-compose.yml'
+
           FAIL=0
           while IFS= read -r f; do
             [ -f "$f" ] || continue
             if head -n 5 "$f" | grep -q "# GENERATED BY"; then
               if git check-ignore -q "$f"; then
                 echo "OK: $f is generated but gitignored."
+              elif [ "$f" = "$ALLOWED_TRACKED_GENERATED" ]; then
+                if literals=$(grep -nE '(PASSWORD|SECRET|KEY|TOKEN)[[:space:]]*[:=]' "$f" | grep -v '\${'); then
+                  echo "ERROR: $f is an allowed tracked generated file, but it now carries literal credential values."
+                  echo "$literals" | sed 's/^/    /'
+                  echo "  Move the value into .env and reference it as \${VAR}, or de-track the file."
+                  FAIL=1
+                else
+                  echo "OK: $f is generated and tracked by design (CI E2E provisioning); no literal credentials."
+                fi
               else
                 echo "ERROR: Refusing to commit generated file. Add to .gitignore first."
                 echo "  -> $f"

.github/workflows/security-scan.yml

@@ -206,7 +206,32 @@ jobs:
             # (exits 0, prints "(N ignored)") but the raw JSON does not — so the
             # gate blocked every PR on CVEs already assessed. Apply the same list
             # here, using jq only (no heredocs: this is inside a YAML block scalar).
-            IGNORED=$(jq -r '(.pnpm.auditConfig.ignoreCves // [])[]' package.json 2>/dev/null | jq -R . | jq -s . )
+            #
+            # Read the list from the REPOSITORY ROOT, not from frontend/. This step
+            # runs with working-directory: frontend, so a bare `package.json` here
+            # is frontend/package.json — whose pnpm.auditConfig is empty. The
+            # curated list lives in the root package.json (image-size x2,
+            # extract-zip), so the gate silently applied NO ignores and re-blocked
+            # on advisories that had already been assessed and accepted. One list,
+            # at the root, is the point; two would drift.
+            #
+            # What is on that list, and why each entry is allowed to be there.
+            # An advisory may be ignored ONLY while it has no published fix; the
+            # moment one exists the entry comes off and the dependency is bumped.
+            #   CVE-2025-71330 / CVE-2025-71329  image-size  (GHSA-w3rx-r6r6-pgpr,
+            #     GHSA-5p2g-fcmc-qvqq)  ICNS/JXL/HEIF infinite-loop DoS.
+            #     first_patched_version NONE against <= 2.0.2, which is still npm
+            #     latest. Build-time only, via Metro.
+            #   CVE-2026-56876 / CVE-2026-19693  extract-zip  (GHSA-jmr9-qjv8-65gv,
+            #     GHSA-7pqw-9j4j-h8q3)  two symlink path-traversal advisories on the
+            #     same package. first_patched_version NONE against <= 2.0.1, and
+            #     2.0.1 IS npm latest, so there is nothing to upgrade to. Reaches
+            #     the tree only through devDependencies (@lhci/cli and
+            #     @wdio/appium-service, both via @puppeteer/browsers) unpacking
+            #     archives this repo's CI fetches itself; never shipped to users.
+            # Re-check each on any dependency sweep: `gh api /advisories/<GHSA>`
+            # reporting a first_patched_version means the entry must be removed.
+            IGNORED=$(jq -r '(.pnpm.auditConfig.ignoreCves // [])[]' "${GITHUB_WORKSPACE}/package.json" 2>/dev/null | jq -R . | jq -s . )
             IGNORED=${IGNORED:-[]}
             COUNTS=$(jq -r --argjson ign "$IGNORED" '
               (.advisories // {})

backend/docker-compose.yml

@@ -264,7 +264,7 @@ services:
   # MinIO Object Storage
   # SECURITY: Bound to localhost only - access via nginx reverse proxy
   minio:
-    image: minio/minio:latest
+    image: quay.io/minio/minio:latest
     container_name: ${PROJECT_NAME}_minio
     restart: unless-stopped
     user: "1000:1000"

package.json

@@ -51,7 +51,8 @@
       "nodemailer@<9.1.1": ">=9.1.1 <10.0.0",
       "postcss@<8.5.10": ">=8.5.10",
       "uuid@<11.1.1": ">=11.1.1",
-      "@xmldom/xmldom@<0.8.13": ">=0.8.13",
+      "@xmldom/xmldom@<0.8.15": ">=0.8.15 <0.9.0",
+      "@xmldom/xmldom@>=0.9.0 <0.9.12": ">=0.9.12",
       "react": "^19.2.0",
       "react-dom": "^19.2.0",
       "@types/react": "19.2.17",
@@ -80,7 +81,8 @@
       "immutable@5": "5.1.8",
       "deepmerge-ts@<8.0.0": ">=8.0.0",
       "browserslist@<4.28.7": "^4.28.7",
-      "joi@<17.13.6": ">=17.13.6 <18.0.0"
+      "joi@<17.13.6": ">=17.13.6 <18.0.0",
+      "js-cookie@<3.0.7": ">=3.0.7"
     },
     "patchedDependencies": {
       "@capacitor/cli@6.2.1": "patches/@capacitor__cli@6.2.1.patch"
@@ -89,7 +91,8 @@
       "ignoreCves": [
         "CVE-2025-71330",
         "CVE-2025-71329",
-        "CVE-2026-56876"
+        "CVE-2026-56876",
+        "CVE-2026-19693"
       ]
     }
   },