diff --git a/.trivyignore b/.trivyignore
index 1c4cff7..f085403 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -1,129 +1,2 @@
-# List any vulnerability that are to be accepted
-# See https://aquasecurity.github.io/trivy/v0.35/docs/vulnerability/examples/filter/
-# for more details
-# e.g.
-# CVE-2022-3996
-
-# CVE-2026-1615 — jsonpath (HIGH).
-# Not exploitable here: jsonpath@1.2.1 appears only as a deep transitive of build tooling:
-# react-scripts → react-dev-utils@12 → bfj@7.1.0 → jsonpath@^1.1.1 in both react-client-side
-# package-lock.json files. No app code references it: grep for 'jsonpath'/'bfj' across src/ and
-# server.js in both google-secure-signals and javascript-sdk react-client-side returns nothing.
-# server.js is a plain Express static-file server (require dotenv/fs/path/express only);
-# Dockerfile runs 'npm run build' then 'npm start'=node server.js. bfj/jsonpath execute only
-# during the CRA build, never at runtime, and no attacker-controlled JSON Path expression is
-# ever passed to .query/.nodes/.value/etc.
-# See: UID2-7873
-CVE-2026-1615 exp:2026-12-17
-
-# zlib contrib/untgz demo utility buffer overflow - not exploitable; Alpine does not ship the untgz binary.
-# See: UID2-6704
-CVE-2026-22184 exp:2026-09-09
-
-# GHSA-2p49-hgcm-8545 (HIGH) - svgo removeScripts plugin leaves some executable scripts intact.
-# svgo is build-time-only tooling here: it optimizes the examples' own (trusted) SVG assets at
-# build time and is never run against untrusted input, so it is not reachable at runtime. The
-# app-level svgo (3.x) and postcss-svgo (2.x) could be bumped, but a third copy is svgo 1.3.2
-# bundled inside react-scripts@5's @svgr/webpack@5.5.0, which has NO in-major fix (fixed only in
-# 2.8.3+); forcing it across the major breaks the create-react-app build. Suppressing until
-# react-scripts is upgraded/removed. See: UID2-7555 (fix precedent UID2-6698)
-GHSA-2p49-hgcm-8545 exp:2026-08-23
-
-# CVE-2026-18446 — fast-uri (transitive via ajv) (HIGH).
-# Not exploitable here: react-client-side resolves fast-uri 3.1.4 (prod, via ajv build
-# tooling); client-server & google-secure-signals server-side resolve 3.1.2 dev-only; no direct
-# fast-uri import; sample-app build/dev tooling
-# See: UID2-7633
-CVE-2026-18446 exp:2026-11-06
-
-# CVE-2026-69152 — brace-expansion (npm, transitive via minimatch) (HIGH).
-# Not exploitable here: web-integrations/server-side/package-lock.json:600 brace-
-# expansion@5.0.8 via minimatch@10.2.4 (dev/build tooling); server.js requires only
-# axios/express/cookie-session/ejs/nocache/crypto; no minimatch/glob/brace-expansion on request
-# path
-# See: UID2-7619
-CVE-2026-69152 exp:2026-11-06
-
-# CVE-2026-67213 — nanoid (transitive via postcss) (HIGH).
-# Not exploitable here: nanoid 3.3.16 is a single transitive dep of postcss in both scanned
-# lockfiles (javascript-sdk & google-secure-signals react-client-side). No source imports
-# nanoid or calls customAlphabet/customRandom; postcss uses only the default nanoid() for
-# internal IDs, never the vulnerable custom* functions. postcss runs at CRA build time only.
-# See: UID2-7658
-CVE-2026-67213 exp:2026-11-11
-
-# GHSA-5p4m-2wfm-xmqj — js-yaml (3.15.0 and 4.3.0, transitive npm dependency) (HIGH).
-# Not exploitable here: js-yaml 3.15.0/4.3.0 appear only as dev/build transitives of eslint,
-# react-scripts and @istanbuljs/load-nyc-config in static demo apps (package-lock entries
-# marked dev:true); no source imports js-yaml or calls yaml.load, so no untrusted-YAML runtime
-# path
-# See: UID2-7659
-GHSA-5p4m-2wfm-xmqj exp:2026-11-11
-
-# CVE-2026-73650 — svgo (HIGH).
-# Not exploitable here: svgo appears only in the two scanned react-client-side lockfiles
-# (javascript-sdk & google-secure-signals): svgo@3.3.3 (@svgr/plugin-svgo dep), postcss-svgo's
-# svgo@2.8.1, and svgo@1.3.2 bundled in react-scripts@5/@svgr/webpack@5.5.0. No src/ file
-# imports svgo or calls optimize() (grep in both src trees returned nothing). Dockerfile runs
-# `npm run build` (CRA) then `npm start` -> server.js is plain express serving the static
-# build; svgo runs only at CRA build time on the app's own trusted SVG assets, never against
-# untrusted request input. removeScripts/removeScriptElement plugin is disabled by default and
-# not configured.
-# See: UID2-7707
-CVE-2026-73650 exp:2026-11-18
-
-# CVE-2026-73088 — browserslist (HIGH).
-# Not exploitable here: Both react-client-side apps (javascript-sdk, google-secure-signals) use
-# react-scripts build/start; browserslist is a query array in package.json; no *stats*.json
-# file, no --stats invocation, no opts.stats
-# See: UID2-7802
-CVE-2026-73088 exp:2026-12-02
-
-# CVE-2026-73089 — browserslist (HIGH).
-# Not exploitable here: google-secure-signals lock:5010 browserslist@4.26.3, javascript-sdk
-# lock:4991 browserslist@4.28.0; both are react-scripts@5 CRA apps (build/dev/test scripts).
-# browserslist invoked at webpack/babel build time with fixed 'browserslist' config array; no
-# runtime path accepts attacker-controlled queries.
-# See: UID2-7803
-CVE-2026-73089 exp:2026-12-02
-
-# CVE-2026-75899 — fast-uri (HIGH).
-# Not exploitable here: Flagged lockfiles (google-secure-signals/react-client-side, javascript-
-# sdk/react-client-side) resolve fast-uri 3.1.4 as node_modules/fast-uri declared by ajv
-# (^3.0.1) pulled in by CRA/webpack build tooling; server-side lock resolves 3.1.2 via
-# table>ajv (eslint devtool). Root package.json only lists fast-uri under overrides. No source
-# file imports fast-uri or calls normalize/resolve.
-# See: UID2-7812
-CVE-2026-75899 exp:2026-12-03
-
-# CVE-2026-75931 — fast-uri (HIGH).
-# Not exploitable here: fast-uri@3.1.4 present in react-client-side lock files transitively via
-# ajv (react-scripts/webpack schema-utils); overrides pin in package.json. No source imports of
-# fast-uri/ajv; no fastify. Runtime server.js is a plain Express static file server with no
-# ajv/fast-uri usage and no host-policy resolve() call.
-# See: UID2-7813
-CVE-2026-75931 exp:2026-12-03
-
-# CVE-2026-75975 — fast-uri (HIGH).
-# Not exploitable here: fast-uri@3.1.4 in react-client-side lockfiles (both javascript-sdk and
-# google-secure-signals) solely under ajv; overrides ^3.1.4 in package.json. No source imports
-# fast-uri/ajv. Client-side React example apps; no untrusted-URL normalization before outbound
-# requests.
-# See: UID2-7814
-CVE-2026-75975 exp:2026-12-03
-
-# CVE-2026-76172 — fast-uri (HIGH).
-# Not exploitable here: fast-uri@3.1.4 appears as node_modules/fast-uri under ajv (via ajv-
-# formats, schema-utils, workbox-build) in the react-client-side lockfiles. server.js only
-# requires fs/path/express to serve the static build; no fast-uri/ajv import and no URL
-# resolve/normalize on untrusted input.
-# See: UID2-7815
-CVE-2026-76172 exp:2026-12-03
-
-# js-yaml is only a transitive build-tooling dependency (eslint/react-scripts/test coverage) in the demo apps; not used by served application code
-# See: UID2-7851
-CVE-2026-84375 exp:2026-10-10
-
-# svgo runs only at build time via @svgr/plugin-svgo, postcss-svgo, and CRA's bundled @svgr/webpack, optimizing repo-owned SVGs; each demo app serves only its static build output, no runtime SVG sanitization of user content
-# See: UID2-7852
-CVE-2026-84370 exp:2026-10-10
+# Add accepted vulnerability IDs here with an expiry date and justification.
+# See https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids
diff --git a/web-integrations/google-secure-signals/client-server/Dockerfile b/web-integrations/google-secure-signals/client-server/Dockerfile
index 578ff64..1244c5e 100644
--- a/web-integrations/google-secure-signals/client-server/Dockerfile
+++ b/web-integrations/google-secure-signals/client-server/Dockerfile
@@ -1,15 +1,22 @@
-FROM node:20.11.0-alpine3.18
+FROM node:24.21.0-alpine3.24
 
 WORKDIR /usr/src/app
 
 # Copy package files first for better caching
-COPY package*.json ./
-RUN npm install
+ENV NODE_ENV=production
+
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev \
+    && npm cache clean --force \
+    && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 # Copy application files
-COPY server.js ./
-COPY public ./public/
-COPY views ./views/
+COPY --chown=node:node server.js ./
+COPY --chown=node:node public ./public/
+COPY --chown=node:node views ./views/
 
 EXPOSE 3041
-CMD ["npm", "start"]
\ No newline at end of file
+
+USER node
+
+CMD ["node", "server.js"]
diff --git a/web-integrations/google-secure-signals/client-server/package-lock.json b/web-integrations/google-secure-signals/client-server/package-lock.json
index a801d90..ec91a5a 100644
--- a/web-integrations/google-secure-signals/client-server/package-lock.json
+++ b/web-integrations/google-secure-signals/client-server/package-lock.json
@@ -22,7 +22,7 @@
         "eslint-plugin-testing-library": "^4.6.0"
       },
       "engines": {
-        "node": "20.11.0"
+        "node": "24.21.0"
       }
     },
     "node_modules/@babel/code-frame": {
@@ -357,7 +357,6 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
       "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
       "dev": true,
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -674,10 +673,9 @@
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
-      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
-      "license": "MIT",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
@@ -1237,7 +1235,6 @@
       "integrity": "sha512-VHZ8gX+EDfz+97jGcgyGCyRia/dPOd6Xh9yPv8Bl1+SoaIwD+a/vlrOmGRUyOYu7MwUhc7CxqeaDZU13S4+EpA==",
       "deprecated": "This version is no longer supported. Please see https://eslint.org/version-support for other options.",
       "dev": true,
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "7.12.11",
         "@eslint/eslintrc": "^0.4.3",
diff --git a/web-integrations/google-secure-signals/client-server/package.json b/web-integrations/google-secure-signals/client-server/package.json
index f37c173..3d68743 100644
--- a/web-integrations/google-secure-signals/client-server/package.json
+++ b/web-integrations/google-secure-signals/client-server/package.json
@@ -9,7 +9,7 @@
     "lint": "eslint server.js"
   },
   "engines": {
-    "node": "20.11.0"
+    "node": "24.21.0"
   },
   "dependencies": {
     "axios": ">=1.18.0",
@@ -28,7 +28,7 @@
     "picomatch": "^2.3.2",
     "@babel/plugin-transform-modules-systemjs": ">=7.29.4",
     "fast-uri": ">=3.1.2",
-    "brace-expansion@5": "5.0.8",
+    "brace-expansion@5": "5.0.9",
     "js-yaml@3": "3.15.0"
   },
   "devDependencies": {
diff --git a/web-integrations/google-secure-signals/react-client-side/Dockerfile b/web-integrations/google-secure-signals/react-client-side/Dockerfile
index 5b24afb..020ec18 100644
--- a/web-integrations/google-secure-signals/react-client-side/Dockerfile
+++ b/web-integrations/google-secure-signals/react-client-side/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:20.11.0-alpine3.18 AS builder
+FROM node:24.21.0-alpine3.24 AS builder
 
 WORKDIR /usr/src/app
 
@@ -10,7 +10,7 @@ COPY public ./public
 RUN npm run build
 
 
-FROM node:20.11.0-alpine3.18 AS runtime
+FROM node:24.21.0-alpine3.24 AS runtime
 
 WORKDIR /usr/src/app
 
@@ -19,7 +19,8 @@ ENV PORT=3044
 
 COPY package.json package-lock.json ./
 RUN npm ci --omit=dev \
-    && npm cache clean --force
+    && npm cache clean --force \
+    && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 COPY --chown=node:node server.js ./
 COPY --from=builder --chown=node:node /usr/src/app/build ./build
diff --git a/web-integrations/google-secure-signals/react-client-side/package-lock.json b/web-integrations/google-secure-signals/react-client-side/package-lock.json
index a25fae1..0b3eab4 100644
--- a/web-integrations/google-secure-signals/react-client-side/package-lock.json
+++ b/web-integrations/google-secure-signals/react-client-side/package-lock.json
@@ -5344,11 +5344,10 @@
       "dev": true
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
-      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
-      "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
diff --git a/web-integrations/google-secure-signals/react-client-side/package.json b/web-integrations/google-secure-signals/react-client-side/package.json
index 971434b..656ad3b 100644
--- a/web-integrations/google-secure-signals/react-client-side/package.json
+++ b/web-integrations/google-secure-signals/react-client-side/package.json
@@ -43,7 +43,7 @@
     "shell-quote": "1.9.0",
     "ws": ">=7.5.11",
     "websocket-driver": "^0.7.5",
-    "brace-expansion@5": "5.0.8",
+    "brace-expansion@5": "5.0.9",
     "js-yaml@3": "3.15.0",
     "js-yaml@4": "4.3.0"
   },
diff --git a/web-integrations/google-secure-signals/server-side/Dockerfile b/web-integrations/google-secure-signals/server-side/Dockerfile
index 89a4c62..a2a51f1 100644
--- a/web-integrations/google-secure-signals/server-side/Dockerfile
+++ b/web-integrations/google-secure-signals/server-side/Dockerfile
@@ -1,15 +1,22 @@
-FROM node:20.11.0-alpine3.18
+FROM node:24.21.0-alpine3.24
 
 WORKDIR /usr/src/app
 
 # Copy package files first for better caching
-COPY package*.json ./
-RUN npm install
+ENV NODE_ENV=production
+
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev \
+    && npm cache clean --force \
+    && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 # Copy application files
-COPY server.js ./
-COPY public ./public/
-COPY views ./views/
+COPY --chown=node:node server.js ./
+COPY --chown=node:node public ./public/
+COPY --chown=node:node views ./views/
 
 EXPOSE 3043
-CMD ["npm", "start"]
\ No newline at end of file
+
+USER node
+
+CMD ["node", "server.js"]
diff --git a/web-integrations/google-secure-signals/server-side/package-lock.json b/web-integrations/google-secure-signals/server-side/package-lock.json
index 1a3b59c..8793bc8 100644
--- a/web-integrations/google-secure-signals/server-side/package-lock.json
+++ b/web-integrations/google-secure-signals/server-side/package-lock.json
@@ -24,7 +24,7 @@
         "eslint-plugin-testing-library": "^4.6.0"
       },
       "engines": {
-        "node": "20.11.0"
+        "node": "24.21.0"
       }
     },
     "node_modules/@babel/code-frame": {
@@ -428,7 +428,6 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
       "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
       "dev": true,
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -785,10 +784,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
-      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
-      "license": "MIT",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
@@ -1352,7 +1350,6 @@
       "integrity": "sha512-VHZ8gX+EDfz+97jGcgyGCyRia/dPOd6Xh9yPv8Bl1+SoaIwD+a/vlrOmGRUyOYu7MwUhc7CxqeaDZU13S4+EpA==",
       "deprecated": "This version is no longer supported. Please see https://eslint.org/version-support for other options.",
       "dev": true,
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "7.12.11",
         "@eslint/eslintrc": "^0.4.3",
diff --git a/web-integrations/google-secure-signals/server-side/package.json b/web-integrations/google-secure-signals/server-side/package.json
index 11a5b10..f94d906 100644
--- a/web-integrations/google-secure-signals/server-side/package.json
+++ b/web-integrations/google-secure-signals/server-side/package.json
@@ -9,7 +9,7 @@
     "lint": "eslint server.js"
   },
   "engines": {
-    "node": "20.11.0"
+    "node": "24.21.0"
   },
   "dependencies": {
     "axios": ">=1.18.0",
@@ -30,7 +30,7 @@
     "picomatch": "^2.3.2",
     "@babel/plugin-transform-modules-systemjs": ">=7.29.4",
     "fast-uri": ">=3.1.2",
-    "brace-expansion@5": "5.0.8",
+    "brace-expansion@5": "5.0.9",
     "js-yaml@3": "3.15.0"
   },
   "devDependencies": {
diff --git a/web-integrations/javascript-sdk/client-server/Dockerfile b/web-integrations/javascript-sdk/client-server/Dockerfile
index df9f0be..8dd082a 100644
--- a/web-integrations/javascript-sdk/client-server/Dockerfile
+++ b/web-integrations/javascript-sdk/client-server/Dockerfile
@@ -1,15 +1,22 @@
-FROM node:20.11.0-alpine3.18
+FROM node:24.21.0-alpine3.24
 
 WORKDIR /usr/src/app
 
 # Copy package files first for better caching
-COPY package*.json ./
-RUN npm install
+ENV NODE_ENV=production
+
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev \
+    && npm cache clean --force \
+    && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 # Copy application files
-COPY server.js ./
-COPY public ./public/
-COPY views ./views/
+COPY --chown=node:node server.js ./
+COPY --chown=node:node public ./public/
+COPY --chown=node:node views ./views/
 
 EXPOSE 3032
-CMD ["npm", "start"]
+
+USER node
+
+CMD ["node", "server.js"]
diff --git a/web-integrations/javascript-sdk/client-server/package-lock.json b/web-integrations/javascript-sdk/client-server/package-lock.json
index 39275e9..6a27609 100644
--- a/web-integrations/javascript-sdk/client-server/package-lock.json
+++ b/web-integrations/javascript-sdk/client-server/package-lock.json
@@ -23,7 +23,7 @@
         "eslint-plugin-testing-library": "^4.6.0"
       },
       "engines": {
-        "node": "20.11.0"
+        "node": "24.21.0"
       }
     },
     "node_modules/@babel/code-frame": {
@@ -427,7 +427,6 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
       "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
       "dev": true,
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -784,10 +783,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
-      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
-      "license": "MIT",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
@@ -1340,7 +1338,6 @@
       "integrity": "sha512-VHZ8gX+EDfz+97jGcgyGCyRia/dPOd6Xh9yPv8Bl1+SoaIwD+a/vlrOmGRUyOYu7MwUhc7CxqeaDZU13S4+EpA==",
       "deprecated": "This version is no longer supported. Please see https://eslint.org/version-support for other options.",
       "dev": true,
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "7.12.11",
         "@eslint/eslintrc": "^0.4.3",
diff --git a/web-integrations/javascript-sdk/client-server/package.json b/web-integrations/javascript-sdk/client-server/package.json
index f65acc4..c1ff990 100644
--- a/web-integrations/javascript-sdk/client-server/package.json
+++ b/web-integrations/javascript-sdk/client-server/package.json
@@ -9,7 +9,7 @@
     "lint": "eslint server.js"
   },
   "engines": {
-    "node": "20.11.0"
+    "node": "24.21.0"
   },
   "dependencies": {
     "axios": ">=1.18.0",
@@ -36,7 +36,7 @@
     "@babel/plugin-transform-modules-systemjs": ">=7.29.4",
     "fast-uri": ">=3.1.2",
     "form-data": ">=4.0.6",
-    "brace-expansion@5": "5.0.8",
+    "brace-expansion@5": "5.0.9",
     "js-yaml@3": "3.15.0"
   },
   "resolutions": {
diff --git a/web-integrations/javascript-sdk/react-client-side/Dockerfile b/web-integrations/javascript-sdk/react-client-side/Dockerfile
index 645522c..6a35e67 100644
--- a/web-integrations/javascript-sdk/react-client-side/Dockerfile
+++ b/web-integrations/javascript-sdk/react-client-side/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:20.11.0-alpine3.18 AS builder
+FROM node:24.21.0-alpine3.24 AS builder
 
 WORKDIR /usr/src/app
 
@@ -10,7 +10,7 @@ COPY public ./public
 RUN npm run build
 
 
-FROM node:20.11.0-alpine3.18 AS runtime
+FROM node:24.21.0-alpine3.24 AS runtime
 
 WORKDIR /usr/src/app
 
@@ -19,7 +19,8 @@ ENV PORT=3034
 
 COPY package.json package-lock.json ./
 RUN npm ci --omit=dev \
-    && npm cache clean --force
+    && npm cache clean --force \
+    && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 COPY --chown=node:node server.js ./
 COPY --from=builder --chown=node:node /usr/src/app/build ./build
diff --git a/web-integrations/javascript-sdk/react-client-side/package-lock.json b/web-integrations/javascript-sdk/react-client-side/package-lock.json
index 13dd589..bc46dcf 100644
--- a/web-integrations/javascript-sdk/react-client-side/package-lock.json
+++ b/web-integrations/javascript-sdk/react-client-side/package-lock.json
@@ -5325,11 +5325,10 @@
       "dev": true
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
-      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
-      "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
diff --git a/web-integrations/javascript-sdk/react-client-side/package.json b/web-integrations/javascript-sdk/react-client-side/package.json
index ef11ef9..e6725e7 100644
--- a/web-integrations/javascript-sdk/react-client-side/package.json
+++ b/web-integrations/javascript-sdk/react-client-side/package.json
@@ -43,7 +43,7 @@
     "shell-quote": "1.9.0",
     "ws": ">=7.5.11",
     "websocket-driver": "^0.7.5",
-    "brace-expansion@5": "5.0.8",
+    "brace-expansion@5": "5.0.9",
     "js-yaml@3": "3.15.0",
     "js-yaml@4": "4.3.0"
   },
diff --git a/web-integrations/prebid-integrations/client-server/Dockerfile b/web-integrations/prebid-integrations/client-server/Dockerfile
index 8c90c91..fce985d 100644
--- a/web-integrations/prebid-integrations/client-server/Dockerfile
+++ b/web-integrations/prebid-integrations/client-server/Dockerfile
@@ -1,16 +1,22 @@
-FROM node:20.11.0-alpine3.18
+FROM node:24.21.0-alpine3.24
 
 WORKDIR /usr/src/app
 
 # Copy package files first for better caching
-COPY client-server/package*.json ./
-RUN npm install
+ENV NODE_ENV=production
+
+COPY client-server/package.json client-server/package-lock.json ./
+RUN npm ci --omit=dev \
+    && npm cache clean --force \
+    && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 # Copy application files
-COPY client-server/server.js ./
-COPY client-server/public ./public/
-COPY prebid.js ./prebid.js
+COPY --chown=node:node client-server/server.js ./
+COPY --chown=node:node client-server/public ./public/
+COPY --chown=node:node prebid.js ./prebid.js
 
 EXPOSE 3052
-CMD ["npm", "start"]
 
+USER node
+
+CMD ["node", "server.js"]
diff --git a/web-integrations/prebid-integrations/client-server/package-lock.json b/web-integrations/prebid-integrations/client-server/package-lock.json
index ef585ee..a5e03da 100644
--- a/web-integrations/prebid-integrations/client-server/package-lock.json
+++ b/web-integrations/prebid-integrations/client-server/package-lock.json
@@ -93,10 +93,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
-      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
-      "license": "MIT",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
diff --git a/web-integrations/prebid-integrations/client-server/package.json b/web-integrations/prebid-integrations/client-server/package.json
index 2cb98a8..a955044 100644
--- a/web-integrations/prebid-integrations/client-server/package.json
+++ b/web-integrations/prebid-integrations/client-server/package.json
@@ -26,6 +26,6 @@
     "flatted": "^3.4.2",
     "path-to-regexp": "^8.4.0",
     "form-data": ">=4.0.6",
-    "brace-expansion@5": "5.0.8"
+    "brace-expansion@5": "5.0.9"
   }
 }
diff --git a/web-integrations/server-side/Dockerfile b/web-integrations/server-side/Dockerfile
index ed61f57..cffec1b 100644
--- a/web-integrations/server-side/Dockerfile
+++ b/web-integrations/server-side/Dockerfile
@@ -1,14 +1,21 @@
-FROM node:20.11.0-alpine3.18
+FROM node:24.21.0-alpine3.24
 
 WORKDIR /usr/src/app
 
-COPY package*.json ./
-RUN npm install
+ENV NODE_ENV=production
 
-COPY server.js ./
-COPY public ./public/
-COPY views ./views/
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev \
+    && npm cache clean --force \
+    && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
+
+COPY --chown=node:node server.js ./
+COPY --chown=node:node public ./public/
+COPY --chown=node:node views ./views/
 
 ENV PORT=3033
 EXPOSE 3033
-CMD [ "npm", "start" ]
+
+USER node
+
+CMD ["node", "server.js"]
diff --git a/web-integrations/server-side/package-lock.json b/web-integrations/server-side/package-lock.json
index d98044e..68a36c0 100644
--- a/web-integrations/server-side/package-lock.json
+++ b/web-integrations/server-side/package-lock.json
@@ -24,7 +24,7 @@
         "eslint-plugin-testing-library": "^4.6.0"
       },
       "engines": {
-        "node": "20.11.0"
+        "node": "24.21.0"
       }
     },
     "node_modules/@babel/code-frame": {
@@ -348,7 +348,6 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
       "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
       "dev": true,
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -598,10 +597,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
-      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
-      "license": "MIT",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
@@ -1031,7 +1029,6 @@
       "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.32.0.tgz",
       "integrity": "sha512-VHZ8gX+EDfz+97jGcgyGCyRia/dPOd6Xh9yPv8Bl1+SoaIwD+a/vlrOmGRUyOYu7MwUhc7CxqeaDZU13S4+EpA==",
       "dev": true,
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "7.12.11",
         "@eslint/eslintrc": "^0.4.3",
diff --git a/web-integrations/server-side/package.json b/web-integrations/server-side/package.json
index f4daea0..6613893 100644
--- a/web-integrations/server-side/package.json
+++ b/web-integrations/server-side/package.json
@@ -9,7 +9,7 @@
     "lint": "eslint server.js"
   },
   "engines": {
-    "node": "20.11.0"
+    "node": "24.21.0"
   },
   "dependencies": {
     "axios": ">=1.18.0",
@@ -34,7 +34,7 @@
     "node-forge": "^1.4.0",
     "picomatch": "^2.3.2",
     "form-data": ">=4.0.6",
-    "brace-expansion@5": "5.0.8",
+    "brace-expansion@5": "5.0.9",
     "js-yaml@3": "3.15.0"
   },
   "resolutions": {