Address CVEs

This updates:
- nanoid (JavaScript) (CVE-2024-55565)
- path-to-regexp (JavaScript) (CVE-2024-52798)
- golang.org/x/net (Go) (CVE-2024-45338)

This also updates to Node.js 22.

Many of the CVEs addressed are not in the delivered product, but it can
help to avoid false positives from CVE scanners and avoid CVEs during
development.

Relates:
https://issues.redhat.com/browse/RHOAIENG-17816

Signed-off-by: mprahl <[email protected]>

Author: mprahl

api/go.mod

@@ -4,12 +4,11 @@ go 1.16
 
 require (
 	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1
-	google.golang.org/protobuf v1.30.0
+	google.golang.org/protobuf v1.33.0
 )
 
 replace (
 	github.com/mattn/go-sqlite3 => github.com/mattn/go-sqlite3 v1.14.18
-	golang.org/x/net => golang.org/x/net v0.17.0
-	golang.org/x/net v0.17.0 => golang.org/x/net v0.23.0
+	golang.org/x/net => golang.org/x/net v0.33.0
 	google.golang.org/grpc => google.golang.org/grpc v1.56.3
 )

api/go.sum

@@ -1,4 +1,4 @@
-FROM node:18.18.2 as build
+FROM node:22.13 as build
 
 ARG COMMIT_HASH
 ENV COMMIT_HASH=${COMMIT_HASH}
@@ -25,7 +25,7 @@ RUN mkdir -p ./server/dist && \
 # concatenate them to one file under ./src/server
 RUN ./scripts/yarn-licenses.sh
 
-FROM node:18.18.2-alpine3.17
+FROM node:22.13-alpine
 
 COPY --from=build ./src/frontend/server /server
 COPY --from=build ./src/frontend/build /client

frontend/Dockerfile

@@ -153,6 +153,12 @@
   "resolutions": {
     "workbox-webpack-plugin": "6.6.0"
   },
+  "overrides": {
+    "nanoid": "3.3.8",
+    "express": {
+      "path-to-regexp": "0.1.12"
+    }
+  },
   "homepage": "./",
   "jest": {
     "collectCoverageFrom": [