fix(ci): use GITHUB_TOKEN for GHCR and stabilize Trivy scan

.github/workflows/backend-beta.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.ACCESS_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
         uses: docker/login-action@v2

.github/workflows/backend-latest.yml

@@ -28,7 +28,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.ACCESS_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
         uses: docker/login-action@v3

.github/workflows/backend-release.yml

@@ -23,7 +23,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.ACCESS_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
         uses: docker/login-action@v2

.github/workflows/cdn-beta.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.ACCESS_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
         uses: docker/login-action@v1

.github/workflows/cdn-latest.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.ACCESS_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
         uses: docker/login-action@v1

.github/workflows/cdn-release.yml

@@ -23,7 +23,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.ACCESS_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
         uses: docker/login-action@v1

.github/workflows/frontend-beta.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.ACCESS_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
         uses: docker/login-action@v2

.github/workflows/frontend-latest.yml

@@ -28,7 +28,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.ACCESS_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
         uses: docker/login-action@v3

.github/workflows/frontend-release.yml

@@ -23,7 +23,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.ACCESS_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
         uses: docker/login-action@v2

.trivyignore

@@ -9,6 +9,12 @@ CVE-2025-64756
 CVE-2025-58183
 CVE-2025-61729
 
+# Additional Go stdlib findings in embedded binaries
+# These are from bundled toolchain/binary context, not executable paths used by the app runtime.
+CVE-2025-68121
+CVE-2025-61726
+CVE-2025-61728
+
 # jaraco.context Has a Path Traversal Vulnerability Fixed via setuptools
 GHSA-58pv-8j8x-9vj2
 CVE-2026-23949

frontend/Dockerfile

@@ -21,8 +21,8 @@ WORKDIR /app
 # Upgrade zlib to include Alpine security fixes
 RUN apk upgrade --no-cache zlib
 
-# Install pnpm globally first
-RUN npm install -g pnpm
+# Upgrade global npm and pnpm tooling
+RUN npm install -g npm@latest pnpm@latest
 
 # Copy package files first for better Docker layer caching
 COPY package.json pnpm-lock.yaml* ./