[RodriFS]

Why

#228 bumped Node to 22.23.4, but in the frontend image Node only runs in the build stage. The image that ships is nginx:1.27.2 (Debian 12), which still contains the vulnerable Brotli library: libbrotli1 1.0.9-2+b6, pulled in by curl. Nginx itself doesn't use it, but it's in the image and scanners flag it.

What changes

• swap-frontend/docker/Dockerfile: the runtime stage moves from nginx:1.27.2 to nginx:1.30.6 (Debian 13), which ships libbrotli1 1.1.0-2+deb13u1, a fixed version.

Testing

Built the image locally and ran it with DOMAIN and BACKEND_HOST set:

• The nginx template renders and nginx starts cleanly.
• /, /docs/ and client-side routes return 200. /api returns 502 because no backend was running.
• libbrotli1 in the image is 1.1.0-2+deb13u1.

[Copilot]

🟢 Approval recommended

There are no active review issues for the nginx runtime image update.

No open issues 🎉

What changed in this PR

Updates the frontend’s shipped nginx runtime image to address the Brotli vulnerability described in CVE-2026-111497, complementing the earlier Node build-stage update in #228.

Changes:

• Bumps the production base image from nginx:1.27.2 to nginx:1.30.6.
• Leaves the build stages and nginx configuration unchanged.

File	Description
swap-frontend/​docker/​Dockerfile	Updates the nginx runtime base to obtain the reported fixed Brotli package.

_{Review effort: Balanced}