chore: Update dependencies and fix security vulnerabilities

[runbgp]

No description provided.

[Copilot]

Pull request overview

This PR modernizes the project to address dependency/security updates and aligns the repository with a newer Node.js baseline, including moving runtime/build configuration toward ES modules.

Changes:

• Migrates runtime/build tooling to ESM ("type": "module", ESM server/server.js, ESM Rollup config) and adds ESLint v9 flat config.
• Updates dependencies/devDependencies (Rollup v4, ESLint v9, serve/socket.io) and adds an override for minimatch.
• Updates ops/maintenance assets (Dockerfile base image/entrypoint, GitHub workflows targeting main, Dependabot grouping) and refreshes docs/metadata (README/SECURITY/app.json, etc.).

Reviewed changes

Copilot reviewed 16 out of 20 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
server/server.js	Switches server entrypoint to ESM imports and updates socket.io server initialization.
rollup.config.js	Converts Rollup config to ESM export to match "type": "module".
pm2.json	Removes PM2 process config (Dockerfile no longer uses pm2-runtime).
package.json	Bumps versions, sets ESM mode, updates Node engine floor, and refreshes dependency set.
eslint.config.js	Adds ESLint v9 flat configuration and ignore patterns.
client/source/settings.js	Updates displayed repository link in MOTD art.
client/public/js/cryptalk.min.js	Rebuilds/minifies client bundle output.
app.json	Updates repository link to fork.
SECURITY.md	Updates supported versions table and vulnerability reporting instructions.
README.md	Updates badges, deployment instructions, and fork/maintenance notes.
LICENSE.md	Updates copyright line.
Dockerfile	Moves to node:22-alpine and runs npm start instead of PM2.
.github/workflows/node.js.yml	Updates CI to main, newer actions, and newer Node versions.
.github/workflows/codeql-analysis.yml	Updates branches and CodeQL action major version/schedule.
.github/dependabot.yml	Switches to weekly updates, targets main, and adds grouping.
.github/FUNDING.yml	Removes funding configuration.
.eslintrc.json	Removes legacy ESLint config in favor of flat config.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

README states development requires Node.js >=18.0, but package.json declares engines.node as ">=22.0.0". This is confusing for contributors and can lead to setup issues; update the README to match the actual supported Node version range.

Suggested change

	Install node.js (development requires >=18.0), exact procedure is dependant on platform and distribution.
	Install Node.js (development requires >=22.0.0), exact procedure is dependant on platform and distribution.

[Copilot]

server/server.js imports serve-handler directly, but serve-handler is not declared as a direct dependency (only serve is). This relies on transitive dependency resolution and can break on install/dedupe when serve changes its dependency tree. Add serve-handler to dependencies (or stop importing it directly and use an API you depend on explicitly).

Suggested change

	"serve": "^14.2.4",
	"serve": "^14.2.4",
	"serve-handler": "^6.1.5",

[Copilot]

The CodeQL workflow still uses actions/checkout@v2 while the rest of the workflow has been updated (e.g., codeql-action v3). checkout@v2 is deprecated and may miss security/performance fixes; update it to actions/checkout@v4 for consistency with the Node CI workflow.

[Copilot]

Because this Dockerfile does not specify a non-root USER, the npm start process runs as root inside the container, which significantly increases the impact of any remote code execution or container breakout vulnerability. An attacker who gains code execution in the app would immediately have root in the container, making it easier to access host resources or other services if the container or runtime is misconfigured. Consider running the app as a dedicated unprivileged user (for example the built-in node user) before CMD ["npm", "start"] or enforcing a non-root user at runtime.