fix(deps): patch Dependabot vulnerability alerts (Python + web) (#2762)

Python (pyproject.toml + uv.lock):
- Pillow >=13.0.0 (52 alerts closed, including 4 critical, 33 high, 15 medium)
- pyjwt >=2.15.0 (15 alerts closed, including 1 critical, 8 high, 6 medium)
- aiohttp >=3.14.4 (11 alerts closed)
- virtualenv -> 21.14.13 (12 alerts closed)
- mcp >=1.30.0,<2.0.0 (4 alerts closed)
- soupsieve -> 3.0.4 (4 alerts closed)
- urllib3 >=2.8.0 (3 alerts closed)
- transformers -> 5.20.2 (3 alerts closed)
- anyio -> 4.14.2 (2 alerts closed, including 1 critical)
- oauthlib -> 4.0.0 (2 alerts closed)
- certifi >=2026.10.19 (1 critical alert closed)
- uv >=0.13.4 (1 critical alert closed)
- sentence-transformers -> 6.2.0 (1 critical alert closed)
- cryptography >=50.0.0, fsspec -> 2026.9.0, h2 -> 4.4.1, hpack -> 4.2.0
- langgraph-sdk -> 0.4.8, litellm >=1.88.6, Mako >=1.4.2, multidict -> 7.1.0
- opentelemetry-api -> 1.45.1, pip >=26.2.0, setuptools -> 84.2.1, torch -> 2.14.1, werkzeug -> 3.1.9
- PyPDF2: replaced with pypdf>=6.0.0 (deprecated PyPDF2 had no upstream fix; closes 1 medium alert)

Web (web/package.json + dual lockfiles npm + pnpm in sync):
- axios 1.17.0 -> 1.20.0 (22 alerts closed)
- vite 8.0.16 -> 8.3.4 (5 alerts closed)
- react-router / react-router-dom 7.17.0 -> 7.18.4 (5 alerts closed)
- brace-expansion -> 1.1.21 & 5.0.12 (4 alerts closed)
- js-yaml -> 4.3.2 (3 alerts closed)
- follow-redirects -> 1.16.1 (2 alerts closed)
- nanoid -> 3.3.18 / 3.3.20 (2 alerts closed)
- postcss -> 8.5.31 (2 alerts closed)
- @humanfs/node -> 0.16.8 (1 alert closed)
- source-map-js -> 1.2.2 (1 alert closed)

Unfixable upstream (pending ChromaDB release):
- chromadb (4 open alerts: GHSA-36p7-vc44-83pf, GHSA-2wm9-hf6c-p5cr, GHSA-xph7-9rjv-w5fr, GHSA-f4j7-r4q5-qw2c; vulnerable range <=1.5.9, latest published version is 1.5.9 with no patched release).

Verified: uv sync + core imports, pytest test suites, pnpm build, pnpm lint.

Co-authored-by: multica-agent <[email protected]>

web/package.json

@@ -18,15 +18,26 @@
     ]
   },
   "overrides": {
-    "js-yaml": ">=4.2.0 <5",
+    "js-yaml": ">=4.3.2 <5",
     "form-data": ">=4.0.6",
     "@radix-ui/react-focus-scope": "1.1.7",
     "flatted": ">=3.4.2",
-    "follow-redirects": ">=1.16.0",
+    "follow-redirects": ">=1.16.1",
     "minimatch@>=3.0.0 <3.1.3": "3.1.3",
     "minimatch@>=9.0.0 <9.0.7": "9.0.7",
     "picomatch@>=2.0.0 <2.3.2": "2.3.2",
-    "picomatch@>=4.0.0 <4.0.4": "4.0.4"
+    "picomatch@>=4.0.0 <4.0.4": "4.0.4",
+    "brace-expansion@<1.1.21": "1.1.21",
+    "brace-expansion@>=3.0.0 <5.0.12": "5.0.12",
+    "[email protected]": {
+      "brace-expansion": "1.1.21"
+    },
+    "[email protected]": {
+      "brace-expansion": "5.0.12"
+    },
+    "nanoid@<3.3.18": "3.3.18",
+    "@humanfs/node": ">=0.16.8",
+    "source-map-js": ">=1.2.2"
   },
   "dependencies": {
     "@dnd-kit/core": "^6.3.1",
@@ -60,7 +71,7 @@
     "@tailwindcss/postcss": "^4.1.5",
     "@tanstack/react-table": "^8.21.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "axios": "^1.16.0",
+    "axios": "^1.20.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
@@ -70,7 +81,7 @@
     "input-otp": "^1.4.2",
     "lodash": "^4.18.0",
     "lucide-react": "^0.507.0",
-    "postcss": "^8.5.10",
+    "postcss": "^8.5.31",
     "qrcode": "^1.5.4",
     "radix-ui": "^1.6.0",
     "react": "19.2.1",
@@ -79,7 +90,7 @@
     "react-i18next": "^15.5.1",
     "react-markdown": "^10.1.0",
     "react-photo-view": "^1.2.7",
-    "react-router-dom": "^7.15.0",
+    "react-router-dom": "^7.18.4",
     "react-syntax-highlighter": "^16.1.0",
     "recharts": "2.15.4",
     "rehype-autolink-headings": "^7.1.0",
@@ -92,7 +103,7 @@
     "tailwind-merge": "^3.2.0",
     "tailwindcss": "^4.1.5",
     "uuidjs": "^5.1.0",
-    "vite": "^8.0.16",
+    "vite": "^8.3.4",
     "zod": "^3.24.4"
   },
   "devDependencies": {
@@ -124,14 +135,21 @@
   "packageManager": "[email protected]+sha512.b9d35fe91b2a5854dadc43034a3e7b2e675fa4b56e20e8e09ef078fa553c18f8aed44051e7b36e8b8dd435f97eb0c44c4ff3b44fc7c6fa7d21e1fac17bbe661e",
   "pnpm": {
     "overrides": {
-      "js-yaml": ">=4.2.0 <5",
+      "js-yaml": ">=4.3.2 <5",
       "form-data": ">=4.0.6",
       "minimatch@>=3.0.0 <3.1.3": "3.1.3",
       "minimatch@>=9.0.0 <9.0.7": "9.0.7",
       "picomatch@>=2.0.0 <2.3.2": "2.3.2",
       "picomatch@>=4.0.0 <4.0.4": "4.0.4",
       "flatted": ">=3.4.2",
-      "follow-redirects": ">=1.16.0"
+      "follow-redirects": ">=1.16.1",
+      "brace-expansion@<1.1.21": "1.1.21",
+      "brace-expansion@>=3.0.0 <5.0.12": "5.0.12",
+      "[email protected]>brace-expansion": "1.1.21",
+      "[email protected]>brace-expansion": "5.0.12",
+      "nanoid@<3.3.18": "3.3.18",
+      "@humanfs/node": ">=0.16.8",
+      "source-map-js": ">=1.2.2"
     }
   }
 }