Repository navigation
A dependency refresh that clears the advisories the 2026-10-25 OSV scan reported in the lockfiles; the code is unchanged. In uv.lock certifi moves from 2026.7.22 to 2026.10.19 (GHSA-6q48-6c7w-9gw2) and urllib3 from 2.7.0 to 2.8.0 (GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g and GHSA-vxq7-64xx-v4gw). In web/package-lock.json Vite moves from 7.3.6 to 7.3.7 (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw and GHSA-rq7h-c2jc-7f22), with its exact pin in web/package.json, and source-map-js from 1.2.1 to 1.2.2 (GHSA-68fv-2mgg-jv7q). Each package moved to the lowest release that fixes its advisories, nothing else in either lockfile moved, and the same scan reports no vulnerable package at this commit.
certifi and urllib3 both ship in the image and in the bundle make lambda-zip builds: certifi through httpx, which the Messages API client and the Jira and Slack tools use, and urllib3 through boto3 and botocore. The Vite advisories concern the development server rather than the built page, and source-map-js is loaded only by the bundler, so neither reaches the deployed demo.
No other commits landed since v6.0.0. CI run 40181952787 (https://github.com/SAY-5/playbook/actions/runs/40181952787) passed on the merge commit 02d42c8: 48 tests pass and 2 skip by design, the Lambda bundle builds and its handler imports, and the web job ran the type-check, the self-check, the production bundle and the Chrome smoke test on Vite 7.3.7.