fix(deps): patch Dependabot vulnerability alerts (Python + web) (#2762)

Python (pyproject.toml + uv.lock):
- Pillow >=13.0.0 (52 alerts closed, including 4 critical, 33 high, 15 medium)
- pyjwt >=2.15.0 (15 alerts closed, including 1 critical, 8 high, 6 medium)
- aiohttp >=3.14.4 (11 alerts closed)
- virtualenv -> 21.14.13 (12 alerts closed)
- mcp >=1.30.0,<2.0.0 (4 alerts closed)
- soupsieve -> 3.0.4 (4 alerts closed)
- urllib3 >=2.8.0 (3 alerts closed)
- transformers -> 5.20.2 (3 alerts closed)
- anyio -> 4.14.2 (2 alerts closed, including 1 critical)
- oauthlib -> 4.0.0 (2 alerts closed)
- certifi >=2026.10.19 (1 critical alert closed)
- uv >=0.13.4 (1 critical alert closed)
- sentence-transformers -> 6.2.0 (1 critical alert closed)
- cryptography >=50.0.0, fsspec -> 2026.9.0, h2 -> 4.4.1, hpack -> 4.2.0
- langgraph-sdk -> 0.4.8, litellm >=1.88.6, Mako >=1.4.2, multidict -> 7.1.0
- opentelemetry-api -> 1.45.1, pip >=26.2.0, setuptools -> 84.2.1, torch -> 2.14.1, werkzeug -> 3.1.9
- PyPDF2: replaced with pypdf>=6.0.0 (deprecated PyPDF2 had no upstream fix; closes 1 medium alert)

Web (web/package.json + dual lockfiles npm + pnpm in sync):
- axios 1.17.0 -> 1.20.0 (22 alerts closed)
- vite 8.0.16 -> 8.3.4 (5 alerts closed)
- react-router / react-router-dom 7.17.0 -> 7.18.4 (5 alerts closed)
- brace-expansion -> 1.1.21 & 5.0.12 (4 alerts closed)
- js-yaml -> 4.3.2 (3 alerts closed)
- follow-redirects -> 1.16.1 (2 alerts closed)
- nanoid -> 3.3.18 / 3.3.20 (2 alerts closed)
- postcss -> 8.5.31 (2 alerts closed)
- @humanfs/node -> 0.16.8 (1 alert closed)
- source-map-js -> 1.2.2 (1 alert closed)

Unfixable upstream (pending ChromaDB release):
- chromadb (4 open alerts: GHSA-36p7-vc44-83pf, GHSA-2wm9-hf6c-p5cr, GHSA-xph7-9rjv-w5fr, GHSA-f4j7-r4q5-qw2c; vulnerable range <=1.5.9, latest published version is 1.5.9 with no patched release).

Verified: uv sync + core imports, pytest test suites, pnpm build, pnpm lint.

Co-authored-by: multica-agent <[email protected]>

pyproject.toml

@@ -8,30 +8,30 @@ requires-python = ">=3.11,<4.0"
 dependencies = [
     "aiocqhttp>=1.4.4",
     "aiofiles>=24.1.0",
-    "aiohttp>=3.14.1",
+    "aiohttp>=3.14.4",
     "aioshutil>=1.5",
     "aiosqlite>=0.21.0",
     "anthropic>=0.51.0",
     "argon2-cffi>=23.1.0",
     "async-lru>=2.0.5",
-    "certifi>=2025.4.26",
+    "certifi>=2026.10.19",
     "colorlog~=6.6.0",
-    "cryptography>=48.0.1",
+    "cryptography>=50.0.0",
     "dashscope>=1.25.10",
     "dingtalk-stream>=0.24.0",
     "discord-py>=2.5.2",
     "pynacl>=1.5.0", # Required for Discord voice support
     "gewechat-client>=0.1.5",
     "lark-oapi>=1.5.5",
-    "mcp>=1.25.0,<2.0.0",
+    "mcp>=1.30.0,<2.0.0",
     "nakuru-project-idk>=0.0.2.1",
     "ollama>=0.4.8",
     "openai>1.0.0",
-    "pillow>=12.2.0",
+    "pillow>=13.0.0",
     "psutil>=7.0.0",
     "pycryptodome>=3.22.0",
     "pydantic>2.0",
-    "pyjwt>=2.12.0",
+    "pyjwt>=2.15.0",
     "python-telegram-bot>=22.0",
     "pyyaml>=6.0.2",
     "qq-botpy-rc>=1.2.1.6",
@@ -46,15 +46,15 @@ dependencies = [
     "sqlmodel>=0.0.24",
     "telegramify-markdown>=0.5.1",
     "tiktoken>=0.9.0",
-    "urllib3>=2.7.0",
+    "urllib3>=2.8.0",
     "websockets>=15.0.1",
     "python-socks>=2.7.1", # dingtalk missing dependency
-    "pip>=26.1",
+    "pip>=26.2.0",
     "ruff>=0.11.9",
     "pre-commit>=4.2.0",
-    "uv>=0.11.15",
+    "uv>=0.13.4",
     "mypy>=1.16.0",
-    "PyPDF2>=3.0.1",
+    "pypdf>=6.0.0",
     "python-docx>=1.1.0",
     "pandas>=2.2.2",
     "chardet>=5.2.0",
@@ -67,7 +67,7 @@ dependencies = [
     "langchain-core>=1.3.3",
     "langsmith>=0.8.18",
     "python-multipart>=0.0.27",
-    "Mako>=1.3.12",
+    "Mako>=1.4.2",
     "langchain-text-splitters>=1.1.2",
     "chromadb>=1.0.0,<2.0.0",
     "qdrant-client (>=1.15.1,<2.0.0)",
@@ -80,7 +80,7 @@ dependencies = [
     "pymilvus>=2.6.4",
     "pgvector>=0.4.1",
     "botocore>=1.42.39",
-    "litellm>=1.0.0",
+    "litellm>=1.88.6",
     "valkey-glide>=2.5.2,<3.0.0; sys_platform != 'win32'", # No Windows wheels are published
     "webauthn>=3.0.0",
     "httpx[socks]>=0.28.1",