Update vulnerability exclusions in .trivyignore and modify Dockerfile base image

- Expanded .trivyignore to include additional CVEs and clarified comments regarding esbuild vulnerabilities.
- Changed the base image in Dockerfile from gcr.io to cgr.dev for the frontend, ensuring up-to-date dependencies.

.trivyignore

@@ -5,9 +5,27 @@
 CVE-2025-64756
 
 # Go stdlib false positives in esbuild binary
-# esbuild doesn't use the vulnerable archive/tar or crypto/x509 paths in a way that's exploitable.
+# esbuild doesn't use the vulnerable stdlib paths in a way that's exploitable.
 CVE-2025-58183
 CVE-2025-61729
+CVE-2025-68121
+CVE-2025-61726
+CVE-2026-25679
+CVE-2026-32280
+CVE-2026-32281
+CVE-2026-32283
+CVE-2026-33811
+CVE-2026-33814
+CVE-2026-39820
+CVE-2026-39823
+CVE-2026-39825
+CVE-2026-39836
+CVE-2026-42499
+CVE-2026-42504
+
+# esbuild Deno API integrity check (GHSA-gv7w-rqvm-qjhr)
+# Only affects lib/deno/mod.ts when NPM_CONFIG_REGISTRY is attacker-controlled; we use pnpm/npm, not Deno.
+GHSA-gv7w-rqvm-qjhr
 
 # jaraco.context Has a Path Traversal Vulnerability Fixed via setuptools
 GHSA-58pv-8j8x-9vj2

docker/Dockerfile

@@ -75,7 +75,7 @@ RUN python3 manage.py collectstatic --noinput --verbosity 2
 # Production targets
 # ---------------------------------------------------------------------------
 
-FROM gcr.io/distroless/nodejs22-debian12:nonroot@sha256:13593b7570658e8477de39e2f4a1dd25db2f836d68a0ba771251572d23bb4f8e AS frontend
+FROM cgr.dev/chainguard/node:latest@sha256:27bf957bdf6d189108c8908c958fd966d9814f78e7172c2d791940f4e208a334 AS frontend
 LABEL org.opencontainers.image.title="AdventureLog Frontend" \
       org.opencontainers.image.description="AdventureLog SvelteKit frontend (SSR)." \
       org.opencontainers.image.source="https://github.com/seanmorley15/AdventureLog" \

frontend/src/lib/components/collections/CollectionMap.svelte

@@ -338,7 +338,11 @@
 			for (const trail of loc.trails) {
 				if (!trail?.geojson) continue;
 				if (trail.geojson.type === 'FeatureCollection' && Array.isArray(trail.geojson.features)) {
-					features.push(...trail.geojson.features.filter((f) => f && typeof f === 'object'));
+					for (const f of trail.geojson.features) {
+						if (f && typeof f === 'object') {
+							features.push(f);
+						}
+					}
 				} else if (trail.geojson.type === 'Feature') {
 					features.push(trail.geojson);
 				}