fix(security): resolve Dependabot alerts

README.md

@@ -447,7 +447,7 @@ Open findings are tracked inline with `TODO (security)` comments in source.
 Summary from `docs/DEPENDENCIES.md`:
 
 - Production audit: no known vulnerabilities.
-- Node 26.5.0, NestJS 11.1.28, Prisma 7.8.0, Axios 1.18.1,
+- Node 26.5.0, NestJS 11.1.28, Prisma 7.9.0, Axios 1.18.1,
   Lodash 4.18.1, qs 6.15.3, and UUID 14.0.1 are locked in the
   security candidate.
 - Security overrides for affected transitives are maintained in

docs/DEPENDENCIES.md

@@ -10,14 +10,14 @@ Toolchain used for this verification cycle:
 
 - Node: `v26.5.0`
 - pnpm: `10.28.2`
-- Prisma CLI, client, and PostgreSQL adapter: `7.8.0`
-- Verification date: `2026-07-20`
+- Prisma CLI, client, and PostgreSQL adapter: `7.9.0`
+- Verification date: `2026-07-22`
 
 Run `nvm use` from this project directory before each Node or pnpm command.
 The standard verification commands are:
 
 ```bash
-pnpm audit --prod --audit-level=moderate
+pnpm audit
 pnpm lint
 pnpm build
 pnpm test --runInBand
@@ -38,19 +38,20 @@ The remediated direct dependency set includes:
 | Node.js | 26.5.0 |
 | NestJS common, core, platform, and testing | 11.1.28 |
 | NestJS Swagger | 11.4.6 |
-| Prisma CLI, client, and PostgreSQL adapter | 7.8.0 |
+| Prisma CLI, client, and PostgreSQL adapter | 7.9.0 |
 | AWS SDK S3 client and request presigner | 3.1090.0 |
 | Axios | 1.18.1 |
 | Lodash | 4.18.1 |
 | qs | 6.15.3 |
 | UUID | 14.0.1 |
 
-`pnpm-workspace.yaml` constrains vulnerable transitive ranges for Axios, Hono,
-Fast XML Parser, Multer, Path-to-RegExp, file-type, form-data, js-yaml,
-brace-expansion, Joi, and related packages. The generated lockfile is the
-authoritative record of their resolved versions.
+`pnpm-workspace.yaml` constrains vulnerable transitive ranges for Axios, Babel,
+Body Parser, Fast URI, Fast XML Parser, Hono's Node server, Multer,
+Path-to-RegExp, file-type, form-data, js-yaml, brace-expansion, Handlebars, Joi,
+Piscina, UUID, archive utilities, and related packages. The generated lockfile
+is the authoritative record of their resolved versions.
 
-Prisma 7.8.0 currently prints an upstream support-list warning under Node 26.
+Prisma 7.9.0 currently prints an upstream support-list warning under Node 26.
 The four committed external generated clients also retain their existing Prisma
 6.19.x runtimes. Client generation, lint, build, migrations, the primary health
 query, and explicit connection queries through all four external clients are
@@ -114,8 +115,8 @@ Update this table whenever dependency or image contents change.
 
 | Command | Result |
 | --- | --- |
-| `pnpm install --frozen-lockfile` | Passed; Prisma 7.8.0 client generated |
-| `pnpm audit --prod --audit-level=moderate` | Passed: no known vulnerabilities |
+| `pnpm install --frozen-lockfile` | Passed; Prisma 7.9.0 client generated |
+| `pnpm audit` | Passed: 0 critical, high, moderate, low, or informational advisories |
 | `pnpm lint` | Passed |
 | `pnpm build` | Passed |
 | `pnpm test --runInBand` | 46 of 57 suites and 360 of 375 tests passed; 10 existing event-publish mock expectations and 5 JWT fixture expectations remain stale on `dev` |

package.json

@@ -33,8 +33,8 @@
     "@nestjs/mapped-types": "^2.1.0",
     "@nestjs/platform-express": "^11.1.28",
     "@nestjs/swagger": "^11.4.6",
-    "@prisma/adapter-pg": "7.8.0",
-    "@prisma/client": "7.8.0",
+    "@prisma/adapter-pg": "7.9.0",
+    "@prisma/client": "7.9.0",
     "@topcoder/challenge-api-v6": "github:topcoder-platform/challenge-api-v6#8ca7e4d065d15a077c648e4d04b85b73276cc078&path:packages/challenge-prisma-client",
     "@topcoder/member-api-v6": "github:topcoder-platform/member-api-v6#a0ffd68bd7c63bbf525459b1e195d6d38ab26a91&path:packages/member-prisma-client",
     "@topcoder/resource-api-v6": "github:topcoder-platform/resource-api-v6#c64ffdccbed62533528dce55d33484be5e035d89&path:packages/resources-prisma-client",
@@ -46,7 +46,7 @@
     "jsonwebtoken": "^9.0.2",
     "jwks-rsa": "^3.2.0",
     "lodash": "^4.18.1",
-    "prisma": "7.8.0",
+    "prisma": "7.9.0",
     "qs": "^6.15.3",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.1",