Remediate September 2026 security findings

[jmgasper]

Summary

• upgrade Node to 26.5.1 and pin patched dependency lines for all open high-severity Dependabot findings, including the newly published brace-expansion 5.0.9 fix
• harden authorization redirects with URL parsing, domain-boundary allowlisting, encoded Auth0 parameters, and state-bound destinations
• reject array-valued request parameters before string operations and cap legacy hash/token extraction work
• replace biased secret generation with crypto.randomInt, replace bare SSO hashing with the memory-hard scrypt KDF, and remove credential/reset-token logging
• return authorization JSON through Nest serialization rather than an explicit response sink
• use an Alpine 3.24 production runtime with dynamically linked Node 26.5.1/OpenSSL 3.5.8, no npm/pnpm, and UID 10001

Security coverage

Dependabot: js-yaml 3.15.1, 4.3.1, and 5.2.2; fast-uri 3.1.5; deepmerge-ts 8.0.0; brace-expansion 1.1.18 and 5.0.9.

CodeQL: insufficient password hashing, unvalidated redirect, reflected XSS response sink, ten parameter type-confusion paths, loop-bound injection, biased cryptographic random generation, and clear-text credential logging.

ECR: Node 26.5.1, Alpine OpenSSL 3.5.8-r0, patched production dependencies, non-root runtime, and no package-manager tooling. The exact final commit image was pushed as identity-api-v6:september2026-security-dc85c47-inspector; deployed numeric tags were not modified.

Validation

• pnpm lint passed
• pnpm build passed
• pnpm audit --audit-level=moderate reports no known vulnerabilities
• 54 authorization/common utility tests passed
• focused regression tests for scrypt/token parameter guards, reset redirect allowlisting, and handle type/bounds passed
• production Docker build passed; runtime inspection confirms UID 10001, Node 26.5.1, nodejs-current 26.5.1-r0, libcrypto/libssl 3.5.8-r0, dynamic OpenSSL linkage, and no npm/pnpm
• Trivy 0.72.0 reports zero fixable critical/high/medium findings across Alpine and Node packages
• AWS Inspector scanned the exact final image successfully with zero active critical/high/medium findings
• GitHub CodeQL and GitHub Trivy checks pass; the branch has zero open critical/high/medium code-scanning alerts

The complete pre-existing Jest suite is not green on develop: 13 suites / 462 tests pass and 9 suites / 67 tests fail, primarily stale test signatures, mocks, and assertions unrelated to these security changes. All focused tests for this remediation pass.

Compatibility note

The SSO token wire shape remains userId|hex-digest, but the digest is now derived with scrypt instead of the legacy bare SHA-256 construction. Consumers that independently recompute the digest must adopt the scrypt construction during rollout.

[jmgasper]

AWS Inspector verification completed successfully. The single-platform verification image identity-api-v6:september2026-security-1b013b1-inspector scanned with status ACTIVE / SUCCESSFUL at 2026-09-01 09:29 AEST and has 0 active critical, high, or medium findings. Existing deployed numeric tags were not changed.

[jmgasper]

Final verification update for commit dc85c47: GitHub CodeQL and both Trivy checks pass; the branch API reports 0 open critical/high/medium code-scanning alerts. AWS Inspector scanned identity-api-v6:september2026-security-dc85c47-inspector successfully and reports 0 active critical/high/medium findings.