fix(deps): patch Dependabot vulnerability alerts (Python + web)

Python (pyproject.toml + uv.lock): - aiohttp 3.13.5->3.14.0, langchain-core 1.3.2->1.4.1, langsmith 0.7.36->0.8.9, lxml 6.0.2->6.1.1, Mako 1.3.11->1.3.12, PyJWT 2.11.0->2.13.0, python-multipart 0.0.26->0.0.32, urllib3 2.6.3->2.7.0, Pygments 2.19.2->2.20.0, idna 3.11->3.18, pip 26.0->26.1.2, python-dotenv 1.2.1->1.2.2, requests 2.32.5->2.34.2, starlette 0.52.1->1.2.1, uv 0.11.7->0.11.19 web (package.json + both lockfiles): - axios ->1.17.0, postcss ->8.5.15, react-router(-dom) ->7.17.0 (direct) - overrides for transitive: flatted >=3.4.2, follow-redirects >=1.16.0, minimatch (3.1.3 / 9.0.7), picomatch (2.3.2 / 4.0.4) - regenerated both package-lock.json and pnpm-lock.yaml in sync Verified: uv sync + core imports OK; pnpm --frozen-lockfile + tsc + vite build pass. Not fixable (no upstream patch yet, tracked separately): - chromadb (critical, <=1.5.9 is latest) — awaiting upstream release - PyPDF2 (medium, deprecated; needs migration to pypdf, code change)
2026-06-10 07:46:02 +00:00 · 2026-06-06 06:06:53 -04:00
parent 46db4de11a
commit efe32e34ae
5 changed files with 2416 additions and 489 deletions
--- a/web/package-lock.json
+++ b/web/package-lock.json
--- a/web/package.json
+++ b/web/package.json
@@ -16,7 +16,13 @@
    ]
  },
  "overrides": {
-    "@radix-ui/react-focus-scope": "1.1.7"
+    "@radix-ui/react-focus-scope": "1.1.7",
+    "flatted": ">=3.4.2",
+    "follow-redirects": ">=1.16.0",
+    "minimatch@>=3.0.0 <3.1.3": "3.1.3",
+    "minimatch@>=9.0.0 <9.0.7": "9.0.7",
+    "picomatch@>=2.0.0 <2.3.2": "2.3.2",
+    "picomatch@>=4.0.0 <4.0.4": "4.0.4"
  },
  "dependencies": {
    "@dnd-kit/core": "^6.3.1",
@@ -46,7 +52,7 @@
    "@tailwindcss/postcss": "^4.1.5",
    "@tanstack/react-table": "^8.21.3",
    "@vitejs/plugin-react": "^6.0.1",
-    "axios": "^1.15.0",
+    "axios": "^1.16.0",
    "class-variance-authority": "^0.7.1",
    "clsx": "^2.1.1",
    "highlight.js": "^11.11.1",
@@ -55,7 +61,7 @@
    "input-otp": "^1.4.2",
    "lodash": "^4.18.0",
    "lucide-react": "^0.507.0",
-    "postcss": "^8.5.3",
+    "postcss": "^8.5.10",
    "qrcode": "^1.5.4",
    "react": "19.2.1",
    "react-dom": "19.2.1",
@@ -63,7 +69,7 @@
    "react-i18next": "^15.5.1",
    "react-markdown": "^10.1.0",
    "react-photo-view": "^1.2.7",
-    "react-router-dom": "^7.14.0",
+    "react-router-dom": "^7.15.0",
    "react-syntax-highlighter": "^16.1.0",
    "recharts": "2.15.4",
    "rehype-autolink-headings": "^7.1.0",
@@ -107,7 +113,12 @@
  "packageManager": "pnpm@8.9.2+sha512.b9d35fe91b2a5854dadc43034a3e7b2e675fa4b56e20e8e09ef078fa553c18f8aed44051e7b36e8b8dd435f97eb0c44c4ff3b44fc7c6fa7d21e1fac17bbe661e",
  "pnpm": {
    "overrides": {
-      "minimatch": "3.1.3"
+      "minimatch@>=3.0.0 <3.1.3": "3.1.3",
+      "minimatch@>=9.0.0 <9.0.7": "9.0.7",
+      "picomatch@>=2.0.0 <2.3.2": "2.3.2",
+      "picomatch@>=4.0.0 <4.0.4": "4.0.4",
+      "flatted": ">=3.4.2",
+      "follow-redirects": ">=1.16.0"
    }
  }
 }
--- a/web/pnpm-lock.yaml
+++ b/web/pnpm-lock.yaml
@@ -5,7 +5,12 @@ settings:
  excludeLinksFromLockfile: false

 overrides:
-  minimatch: 3.1.3
+  minimatch@>=3.0.0 <3.1.3: 3.1.3
+  minimatch@>=9.0.0 <9.0.7: 9.0.7
+  picomatch@>=2.0.0 <2.3.2: 2.3.2
+  picomatch@>=4.0.0 <4.0.4: 4.0.4
+  flatted: '>=3.4.2'
+  follow-redirects: '>=1.16.0'

 dependencies:
  '@dnd-kit/core':
@@ -90,8 +95,8 @@ dependencies:
    specifier: ^6.0.1
    version: 6.0.1(vite@8.0.8)
  axios:
-    specifier: ^1.15.0
-    version: 1.15.0
+    specifier: ^1.16.0
+    version: 1.17.0
  class-variance-authority:
    specifier: ^0.7.1
    version: 0.7.1
@@ -117,8 +122,8 @@ dependencies:
    specifier: ^0.507.0
    version: 0.507.0(react@19.2.1)
  postcss:
-    specifier: ^8.5.3
-    version: 8.5.6
+    specifier: ^8.5.10
+    version: 8.5.15
  qrcode:
    specifier: ^1.5.4
    version: 1.5.4
@@ -141,8 +146,8 @@ dependencies:
    specifier: ^1.2.7
    version: 1.2.7(react-dom@19.2.1)(react@19.2.1)
  react-router-dom:
-    specifier: ^7.14.0
-    version: 7.14.0(react-dom@19.2.1)(react@19.2.1)
+    specifier: ^7.15.0
+    version: 7.17.0(react-dom@19.2.1)(react@19.2.1)
  react-syntax-highlighter:
    specifier: ^16.1.0
    version: 16.1.0(react@19.2.1)
@@ -1866,7 +1871,7 @@ packages:
      '@alloc/quick-lru': 5.2.0
      '@tailwindcss/node': 4.1.18
      '@tailwindcss/oxide': 4.1.18
-      postcss: 8.5.6
+      postcss: 8.5.15
      tailwindcss: 4.1.18
    dev: false

@@ -2117,7 +2122,7 @@ packages:
      '@typescript-eslint/types': 8.54.0
      '@typescript-eslint/visitor-keys': 8.54.0
      debug: 4.4.3
-      minimatch: 3.1.3
+      minimatch: 9.0.7
      semver: 7.7.3
      tinyglobby: 0.2.15
      ts-api-utils: 2.4.0(typescript@5.9.3)
@@ -2186,6 +2191,15 @@ packages:
    hasBin: true
    dev: true

+  /agent-base@6.0.2:
+    resolution: {integrity: sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==}
+    engines: {node: '>= 6.0.0'}
+    dependencies:
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+    dev: false
+
  /ajv@6.12.6:
    resolution: {integrity: sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==}
    dependencies:
@@ -2328,14 +2342,16 @@ packages:
      possible-typed-array-names: 1.1.0
    dev: true

-  /axios@1.15.0:
-    resolution: {integrity: sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==}
+  /axios@1.17.0:
+    resolution: {integrity: sha512-J8SwNxprqqpbfenehxWYXE7CW+wM1BB4w3+N+g+/Wx40xM4rsLrfPmHHxSWIxJLYDgSY/HqlFPIYb2/S3rxafw==}
    dependencies:
-      follow-redirects: 1.15.11
+      follow-redirects: 1.16.0
      form-data: 4.0.5
+      https-proxy-agent: 5.0.1
      proxy-from-env: 2.1.0
    transitivePeerDependencies:
      - debug
+      - supports-color
    dev: false

  /bail@2.0.2:
@@ -2346,6 +2362,11 @@ packages:
    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
    dev: true

+  /balanced-match@4.0.4:
+    resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
+    engines: {node: 18 || 20 || >=22}
+    dev: true
+
  /brace-expansion@1.1.12:
    resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==}
    dependencies:
@@ -2353,6 +2374,13 @@ packages:
      concat-map: 0.0.1
    dev: true

+  /brace-expansion@5.0.6:
+    resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==}
+    engines: {node: 18 || 20 || >=22}
+    dependencies:
+      balanced-match: 4.0.4
+    dev: true
+
  /braces@3.0.3:
    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
    engines: {node: '>=8'}
@@ -3094,7 +3122,7 @@ packages:
    resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
    engines: {node: '>=12.0.0'}
    peerDependencies:
-      picomatch: ^3 || ^4
+      picomatch: 4.0.4
    peerDependenciesMeta:
      picomatch:
        optional: true
@@ -3135,16 +3163,16 @@ packages:
    resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==}
    engines: {node: '>=16'}
    dependencies:
-      flatted: 3.3.3
+      flatted: 3.4.2
      keyv: 4.5.4
    dev: true

-  /flatted@3.3.3:
-    resolution: {integrity: sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==}
+  /flatted@3.4.2:
+    resolution: {integrity: sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==}
    dev: true

-  /follow-redirects@1.15.11:
-    resolution: {integrity: sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==}
+  /follow-redirects@1.16.0:
+    resolution: {integrity: sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==}
    engines: {node: '>=4.0'}
    peerDependencies:
      debug: '*'
@@ -3479,6 +3507,16 @@ packages:
    resolution: {integrity: sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg==}
    dev: false

+  /https-proxy-agent@5.0.1:
+    resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==}
+    engines: {node: '>= 6'}
+    dependencies:
+      agent-base: 6.0.2
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+    dev: false
+
  /human-signals@5.0.0:
    resolution: {integrity: sha512-AXcZb6vzzrFAUE61HnN4mpLqd/cSIwNQjtNWR0euPm6y0iqx3G4gOXaIDdtdDwZmhwe82LA6+zinmW4UBWVePQ==}
    engines: {node: '>=16.17.0'}
@@ -4648,7 +4686,7 @@ packages:
    engines: {node: '>=8.6'}
    dependencies:
      braces: 3.0.3
-      picomatch: 2.3.1
+      picomatch: 2.3.2
    dev: true

  /mime-db@1.52.0:
@@ -4679,11 +4717,18 @@ packages:
      brace-expansion: 1.1.12
    dev: true

+  /minimatch@9.0.7:
+    resolution: {integrity: sha512-MOwgjc8tfrpn5QQEvjijjmDVtMw2oL88ugTevzxQnzRLm6l3fVEF2gzU0kYeYYKD8C66+IdGX6peJ4MyUlUnPg==}
+    engines: {node: '>=16 || 14 >=14.17'}
+    dependencies:
+      brace-expansion: 5.0.6
+    dev: true
+
  /ms@2.1.3:
    resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}

-  /nanoid@3.3.11:
-    resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==}
+  /nanoid@3.3.12:
+    resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==}
    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
    hasBin: true
    dev: false
@@ -4880,8 +4925,8 @@ packages:
    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
    dev: false

-  /picomatch@2.3.1:
-    resolution: {integrity: sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==}
+  /picomatch@2.3.2:
+    resolution: {integrity: sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==}
    engines: {node: '>=8.6'}
    dev: true

@@ -4905,20 +4950,11 @@ packages:
    engines: {node: '>= 0.4'}
    dev: true

-  /postcss@8.5.6:
-    resolution: {integrity: sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==}
+  /postcss@8.5.15:
+    resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==}
    engines: {node: ^10 || ^12 || >=14}
    dependencies:
-      nanoid: 3.3.11
-      picocolors: 1.1.1
-      source-map-js: 1.2.1
-    dev: false
-
-  /postcss@8.5.8:
-    resolution: {integrity: sha512-OW/rX8O/jXnm82Ey1k44pObPtdblfiuWnrd8X7GJ7emImCOstunGbXUpp7HdBrFQX6rJzn3sPT397Wp5aCwCHg==}
-    engines: {node: ^10 || ^12 || >=14}
-    dependencies:
-      nanoid: 3.3.11
+      nanoid: 3.3.12
      picocolors: 1.1.1
      source-map-js: 1.2.1
    dev: false
@@ -5094,8 +5130,8 @@ packages:
      use-sidecar: 1.1.3(@types/react@19.2.10)(react@19.2.1)
    dev: false

-  /react-router-dom@7.14.0(react-dom@19.2.1)(react@19.2.1):
-    resolution: {integrity: sha512-2G3ajSVSZMEtmTjIklRWlNvo8wICEpLihfD/0YMDxbWK2UyP5EGfnoIn9AIQGnF3G/FX0MRbHXdFcD+rL1ZreQ==}
+  /react-router-dom@7.17.0(react-dom@19.2.1)(react@19.2.1):
+    resolution: {integrity: sha512-fyU2yjGups/hE6Xz0I5ZYbVL8Gx29eCjgpHaRaTaVU+OOAdfRX05KsvyRm0GO8YQwOkhpU3MurW1jyMUJn+zSw==}
    engines: {node: '>=20.0.0'}
    peerDependencies:
      react: '>=18'
@@ -5103,11 +5139,11 @@ packages:
    dependencies:
      react: 19.2.1
      react-dom: 19.2.1(react@19.2.1)
-      react-router: 7.14.0(react-dom@19.2.1)(react@19.2.1)
+      react-router: 7.17.0(react-dom@19.2.1)(react@19.2.1)
    dev: false

-  /react-router@7.14.0(react-dom@19.2.1)(react@19.2.1):
-    resolution: {integrity: sha512-m/xR9N4LQLmAS0ZhkY2nkPA1N7gQ5TUVa5n8TgANuDTARbn1gt+zLPXEm7W0XDTbrQ2AJSJKhoa6yx1D8BcpxQ==}
+  /react-router@7.17.0(react-dom@19.2.1)(react@19.2.1):
+    resolution: {integrity: sha512-FDELK7rTMlCHO5+reyXsPlmfr7N1F91lPHsWYfMEGQm/KQ+F4JFM8jGoeQDmDvdTs93Fw9aSilH+uKRb4/jXvQ==}
    engines: {node: '>=20.0.0'}
    peerDependencies:
      react: '>=18'
@@ -6053,7 +6089,7 @@ packages:
      '@types/node': 20.19.30
      lightningcss: 1.32.0
      picomatch: 4.0.4
-      postcss: 8.5.8
+      postcss: 8.5.15
      rolldown: 1.0.0-rc.15
      tinyglobby: 0.2.15
    optionalDependencies: