chore: squash High findings in pepr controller image

[btlghrants]

Description

A manual scan of grype reveals 3 High severity findings:

> docker run --rm \
--volume /var/run/docker.sock:/var/run/docker.sock \
--name Grype anchore/grype:v0.80.0 \
pepr:dev                
NAME            INSTALLED  FIXED-IN  TYPE  VULNERABILITY        SEVERITY 
libcrypto3      3.3.1-r5   3.3.2-r0  apk   CVE-2024-6119        High      
libssl3         3.3.1-r5   3.3.2-r0  apk   CVE-2024-6119        High      
path-to-regexp  0.1.7      0.1.10    npm   GHSA-9wv6-86v2-598j  High

Related Issue

Fixes #1122

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Unit, Journey, E2E Tests, docs, adr added or updated as needed
• Contributor Guide Steps followed

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.65%. Comparing base (db858ae) to head (594a2a6).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1123   +/-   ##
=======================================
  Coverage   85.65%   85.65%           
=======================================
  Files          26       26           
  Lines        1032     1032           
  Branches      222      222           
=======================================
  Hits          884      884           
  Misses        137      137           
  Partials       11       11           

[btlghrants]

Updating to the newest chainguard:node images removes the two "apk" findings, but the "npm" finding remains. Tracking that down now.

docker run --rm --volume /var/run/docker.sock:/var/run/docker.sock --name Grype anchore/grype:v0.80.0 pepr:dev
NAME            INSTALLED  FIXED-IN  TYPE  VULNERABILITY        SEVERITY 
path-to-regexp  0.1.7      0.1.10    npm   GHSA-9wv6-86v2-598j  High

[btlghrants]

Looks like it's express@4.19.2 that's pulling in the borked version of path-to-regexp@0.1.7.

Updating pepr to express@4.20.0 pulls in the newer (and recommended ) version of path-to-regexp@0.1.10.

docker run --rm --volume /var/run/docker.sock:/var/run/docker.sock --name Grype anchore/grype:v0.80.0 pepr:dev
No vulnerabilities found

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/express@4.20.0	Transitive: environment, eval, filesystem, network, unsafe	+66	2.44 MB	blakeembrey, dougwilson, linusu, ...4 more

🚮 Removed packages: npm/express@4.19.2

View full report↗︎