Trivy scan fails on main: CRITICAL/HIGH CVE in floating node:20-alpine base image

Summary

The scan job in .github/workflows/trivy.yml (Trivy image scan, severity: CRITICAL,HIGH, exit-code: 1, ignore-unfixed: true) fails because the built image contains at least one fixable CRITICAL/HIGH vulnerability.

This is pre-existing and unrelated to feature PRs: the workflow has failed on main across multiple recent runs.

Root cause

The Dockerfile builds from a floating base tag:

ARG NODE_IMAGE=node:20-alpine

Because the tag is not pinned to a digest, the scanned base image rolls forward to whatever node:20-alpine currently resolves to (Alpine 3.23.x at last scan). As new CVEs are disclosed and fixes published, ignore-unfixed: true + exit-code: 1 causes the scan to fail intermittently on main without any code change in the repo.

Suggested remediation

• Bump/pin the base image to a current patched digest (the Dockerfile already documents the pinned-digest pattern in a comment), and re-pin periodically (or via Dependabot for Docker), and/or
• Identify the specific failing CVE(s) from the scan SARIF and remediate the affected OS/library package.

Evidence (failing on main, not PR-caused)

• PR #20 job: https://github.com/microsoft/cates/actions/runs/27383522485/job/80925498364
• Prior main failures: run 27125852062 (scheduled, 2026-06-08), run 26888190751 (PR #19 merge), run 26886413257 (PR #18 merge).
• PR #20 changes no package.json, package-lock.json, or Dockerfile.

Note: the Trivy and CodeQL code-scanning upload checks pass; it is specifically the scan job's gating exit-code: 1 that fails.