Repository navigation
A dependency refresh that clears the advisories the 2026-10-25 OSV scan reported in the lockfiles; the code is unchanged. In uv.lock certifi moves from 2026.7.22 to 2026.10.19 (GHSA-6q48-6c7w-9gw2), urllib3 from 2.7.0 to 2.8.0 (GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g and GHSA-vxq7-64xx-v4gw), Mako from 1.4.1 to 1.4.2 (GHSA-5639-2j2p-m4mx) and Werkzeug from 3.1.8 to 3.1.9 (GHSA-g6x2-hccm-hh4m). In web/package-lock.json Vite moves from 6.4.3 to 6.4.4 (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw and GHSA-rq7h-c2jc-7f22) and source-map-js from 1.2.1 to 1.2.2 (GHSA-68fv-2mgg-jv7q). Each package moved to the lowest release that fixes its advisories, nothing else in either lockfile moved, and the same scan reports no vulnerable package at this commit.
certifi and urllib3 are runtime dependencies of the image, certifi through httpx and urllib3 through boto3 and botocore, which the S3 delivery store uses. Werkzeug is installed only with the dev extra, through moto, which the image does not install, and both its advisory and Mako's need Windows, while the image runs Linux. The Vite advisories concern the development server rather than the static browser port, and source-map-js is loaded only by the bundler.
No other commits landed since v6.0.0, and the benchmark sessions and the demo run the README quotes are the 6.0.0 recordings, not re-measured. CI run 40182458666 (https://github.com/SAY-5/panelist/actions/runs/40182458666) passed on the merge commit 3c1d46d: ruff, the 74 tests against PostgreSQL 16, terraform validate, the image build, and the web typecheck, the selfcheck at 123 of 123 assertions, the production bundle and the gzip budget.