Repository navigation
Patch on top of 5.1.0 that moves locked dependencies past published advisories, with no code or schema change. In uv.lock, certifi goes from 2026.7.22 to 2026.10.19 (GHSA-6q48-6c7w-9gw2: the bundle trusted the emSign ECC Root CA - G3 root, under which eight eMudhra intermediates with compromised keys chain), urllib3 from 2.7.0 to 2.8.0 (GHSA-8988-9cw3-xx77, GHSA-vxq7-64xx-v4gw, GHSA-gh4c-6fx4-qh6g) and mako from 1.4.1 to 1.4.2 (GHSA-5639-2j2p-m4mx). certifi is the CA bundle httpx uses for the webhook and Jira targets, so that advisory reaches the service image; urllib3 is installed only with the dev group (through testcontainers and docker), and the mako advisory needs a Windows host, which the python:3.12-slim image is not.
In web/package-lock.json, vite goes from 6.4.3 to 6.4.5 and source-map-js from 1.2.1 to 1.2.2. The vite advisories (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv and GHSA-r825-w8mm-5pxw in the bundled launch-editor, GHSA-9jrq-w75r-8gcw and GHSA-rq7h-c2jc-7f22) concern the development server on Windows, under WSL, in middleware mode or exposed to the network, and source-map-js (GHSA-68fv-2mgg-jv7q) runs only while building; none of them reaches the static demo the build produces.
CI run 40181554931 verified the merge commit f5ee0f5 with ruff and the PostgreSQL test suite. The workflow has no web job, so the web lockfile change was not built in CI.