fix: address all open CodeQL security alerts

app.ts

@@ -32,10 +32,15 @@ registerViewEngine(app);
 
 // Security
 // Defaults https://www.npmjs.com/package/helmet#how-it-works
+// ReSpec pill UI is embedded via iframe on any spec-hosting site,
+// so we must not send frame-ancestors or X-Frame-Options.
+const cspDirectives = helmet.contentSecurityPolicy.getDefaultDirectives();
+delete cspDirectives["frame-ancestors"];
+
 app.use(
   helmet({
-    // Allow for UI inclusion as iframe in ReSpec pill.
     frameguard: false,
+    contentSecurityPolicy: { directives: cspDirectives },
   }),
 );
 

package.json

@@ -16,6 +16,7 @@
     "cors": "^2.8.6",
     "dotenv": "^17.4.2",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.4.0",
     "helmet": "^8.1.0",
     "morgan": "^1.10.1",
     "nanoid": "^5.1.9",
@@ -34,6 +35,11 @@
     "update-data-sources": "node build/scripts/update-data-sources.js"
   },
   "packageManager": "pnpm@9.8.0",
+  "pnpm": {
+    "overrides": {
+      "html-minifier": "npm:html-minifier-terser@^7.2.0"
+    }
+  },
   "simple-git-hooks": {
     "post-merge": "pnpm i && pnpm build"
   },