[swibi-ttd]

Summary

• move all seven Node sample images from Node 20 / Alpine 3.18 to Node 24.21.0 / Alpine 3.24
• install production dependencies only, remove npm and npx from runtime images, run as the non-root node user, and start with node directly
• update brace-expansion to 5.0.9 and remove Trivy exceptions that no longer suppress current findings

This prepares the repository for the all-image scanning introduced by #216.

Vulnerability resolution

The HIGH/CRITICAL findings came from the EOL Alpine 3.18 base, npm and its bundled dependencies in the runtime images, dev-only dependencies installed into server images, and brace-expansion 5.0.8. Each has been fixed rather than ignored.

MEDIUM/LOW dependency findings remain outside this ticket scope.

Verification

• built all 14 Dockerfile/context combinations from the UID2-7877: Scan all sample Docker images for vulnerabilities #216 matrix with fresh base images
• Trivy filesystem scan: zero HIGH/CRITICAL findings without vulnerability exceptions
• Trivy image scans: zero HIGH/CRITICAL findings in all 14 images
• npm audit --omit=dev: zero HIGH/CRITICAL findings in all seven Node apps
• both React production builds pass under Node 24
• all seven Node images run as UID 1000 on Node 24.21.0, contain no npm or npx, and return HTTP 200 for /ops/healthcheck and /

Jira: https://thetradedesk.atlassian.net/browse/UID2-7920