fix(build): clear high-severity grype findings on main

[Alain Uyidi (auyidi1)]

Pull Request

Description

main currently fails the Grype step of the Security Scan job, which fails the required PR Validation Gate on unrelated PRs (for example #831, #834, #825, #824, #797, and #786). Running Grype 0.109.1 with .grype.yaml against main (128cd7ae) reports three findings at or above the high threshold:

Package	Version	Advisory	Fix	Location
basic-ftp	5.3.1	GHSA-c475-qrg2-pj4r (published 2026-10-01)	6.2.1	.github/scripts/markdown-link-check/package-lock.json
braces	3.0.3	GHSA-vfj7-8cjw-p6xm (published 2026-09-18)	None	docs/docusaurus/package-lock.json
http-cache-semantics	4.2.0	GHSA-ch52-4w7c-c8xp (published 2026-09-18)	None	docs/docusaurus/package-lock.json

This PR remediates the fixable finding and documents the two unfixable ones.

Related Issue

Relates to #831

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Blueprint modification or addition
• Component modification or addition
• Documentation update
• CI/CD pipeline change
• Other (please describe):

Implementation Details

basic-ftp override

• Latest get-uri (8.0.1) still requires basic-ftp ^5.3.1, so there is no upstream upgrade path.
• Added an npm overrides entry for basic-ftp: ^6.2.2 in .github/scripts/markdown-link-check/package.json and updated the existing root overrides and resolutions from ^5.3.0 to ^6.2.2. 6.2.2 also fixes GHSA-5rfr-xx34-2xxv.
• get-uri only calls access, lastMod, list, downloadTo, and close. The only 6.0.0 breaking change disables separate transfer hosts by default to prevent FTP bounce attacks; none of these call sites depend on it.
• Lockfile changes are limited to the basic-ftp entry in each lockfile.

Scoped Grype ignores

Both advisories have no patched release. The ignores follow the existing image-size precedent and are scoped by package type and name:

• braces (GHSA-vfj7-8cjw-p6xm): reached through Docusaurus build-time file watching and glob matching (chokidar, micromatch) with repository-controlled patterns.
• http-cache-semantics (GHSA-ch52-4w7c-c8xp): reached only through Docusaurus's update notifier (update-notifier → latest-version → package-json → got → cacheable-request), a single-user CLI version check. The repository does not run a shared HTTP cache.

Both ignores should be removed when patched releases are available.

Testing Performed

• Terraform plan/apply
• Blueprint deployment test
• Unit tests
• Integration tests
• Bug fix includes regression test (see Test Policy)
• Manual validation
• Other: Grype 0.109.1 with .grype.yaml (same version and config as CI)

Validation Steps

1. grype dir:. --config .grype.yaml on main: exit 2 with the three high findings above.
2. Same command on this branch: exit 0 with no high or critical findings.
3. yamllint -c .yamllint.yml .grype.yaml: pass.
4. npm ci --prefix .github/scripts/markdown-link-check installs basic-ftp 6.2.2, and markdown-link-check runs and checks links normally.

Checklist

• I have updated the documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have run terraform fmt on all Terraform code
• I have run terraform validate on all Terraform code
• I have run az bicep format on all Bicep code
• I have run az bicep build to validate all Bicep code
• I have checked for any sensitive data/tokens that should not be committed
• Lint checks pass (run applicable linters for changed file types)

Security Review

• No credentials, secrets, or tokens are hardcoded or logged
• RBAC and identity changes follow least-privilege principles
• No new network exposure or public endpoints introduced without justification
• Dependency additions or updates have been reviewed for known vulnerabilities
• Container image changes use pinned digests or SHA references

Additional Notes

No Terraform, Bicep, or application code changes. The two Grype ignores are risk acceptances and need maintainer review.