Repository navigation
Dependency patch for published advisories. In uv.lock, certifi moves from 2026.7.22 to 2026.10.19 (GHSA-6q48-6c7w-9gw2), urllib3 from 2.7.0 to 2.8.0 (GHSA-8988-9cw3-xx77, GHSA-vxq7-64xx-v4gw, GHSA-gh4c-6fx4-qh6g), mako from 1.4.1 to 1.4.2 (GHSA-5639-2j2p-m4mx) and werkzeug from 3.1.8 to 3.1.9 (GHSA-g6x2-hccm-hh4m). certifi and urllib3 ship in the service images as dependencies of httpx and botocore, so those two fixes reach the running services. The mako and werkzeug advisories apply only on Windows while the service images run on Linux, and werkzeug is only a test dependency, through moto.
In web/pnpm-lock.yaml and showcase/package-lock.json, vite moves from 7.3.6 to 7.3.7 (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-9jrq-w75r-8gcw, GHSA-rq7h-c2jc-7f22) and source-map-js from 1.2.1 to 1.2.2 (GHSA-68fv-2mgg-jv7q), and web/ moves brace-expansion, which it reaches only through ESLint and typescript-eslint, from 1.1.18 to 1.1.21 and from 5.0.9 to 5.0.12 (GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr). These concern the Vite development server and the build and lint toolchain, not the static files the built rider map and showcase serve. Each package moved to the lowest release that clears its advisories, no other locked package moved, and an OSV query of all three lockfiles now finds no advisory.
The release also contains the four commits merged since v5.0.0. 51cdacb (#1) has the showcase present its figures as modeled settings on a virtual clock and the earlier transcripts as unverified history, adds docs/measurement-provenance.md and gives the showcase its own CI job; f2e2ec0 (#2) runs the concurrent claim tests against DynamoDB Local 2.5.2 instead of moto; f31ac39 (#3) aligns the test setup, the trip schema and the measurement provenance in the docs; and a0a8865 puts the historical transcript heading in parentheses. Service code is unchanged apart from the version string, and this release makes no new performance claim. CI on the merge commit 6329c2a passed the python job (ruff and 109 tests against PostgreSQL 16 and DynamoDB Local 2.5.2), the web job and the showcase job.