Repository navigation
A dependency refresh that clears the advisories the 2026-10-25 OSV scan reported in the lockfiles; the service code is unchanged. In uv.lock certifi moves from 2026.7.22 to 2026.10.19 (GHSA-6q48-6c7w-9gw2), urllib3 from 2.7.0 to 2.8.0 (GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g and GHSA-vxq7-64xx-v4gw) and Mako from 1.4.1 to 1.4.2 (GHSA-5639-2j2p-m4mx). In web/package-lock.json Vite moves from 7.3.6 to 7.3.7 (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw and GHSA-rq7h-c2jc-7f22) and source-map-js from 1.2.1 to 1.2.2 (GHSA-68fv-2mgg-jv7q). Each package moved to the lowest release that fixes its advisories, nothing else in either lockfile moved, and the same scan reports no vulnerable package at this commit.
certifi is the one the running service depends on: the worker's httpx client verifies destinations against its bundle, which before 2026.10.19 trusted the emSign ECC Root CA - G3 whose intermediate keys were compromised. urllib3 is installed only with the dev extra, through testcontainers, and the image does not install that extra; the Mako advisory needs Windows, and the image runs Linux; the Vite advisories concern the development server and the source-map-js one the bundler, not the static console they produce.
No other commits landed since v5.1.0. Besides the version strings and the changelog entry, the README's releases section no longer says that the tags carry no GitHub release. CI run 40181807093 (https://github.com/SAY-5/launchbridge/actions/runs/40181807093) passed on the merge commit 3ae9aa3, lint, the 166 tests, the image build, the console and terraform included.