security: clear open Dependabot alerts across all four projects

[ntatsumi]

Clears the open Dependabot alerts — 9 of 10 fixed, the tenth justified via VEX.

Fixed

Alert	Package	Change	Where
1300	nanoid	3.3.16 → 3.3.18	ui/yarn.lock
1275	js-yaml	4.3.0 → 4.3.1	ui/yarn.lock
1259	fast-uri	3.1.4 → 3.1.5	ui/yarn.lock
1232	undici	7.28.0 → 7.29.0	ui/yarn.lock
1276	pdfjs-dist	6.1.200 → 6.2.108	ui/package.json resolutions
1264	cryptography	49.0.0 → 50.0.0	ml-engine
1237	cryptography	49.0.0 → 50.0.0	model-upload
1236	cryptography	49.0.0 → 50.0.0	observability SDK
1045	json-repair	0.52.5 → 0.63.2	observability SDK

Most were plain lockfile refreshes. Two needed more:

• pdfjs-dist is pinned exactly at 6.1.200 by @arthur/shared-components, so no range bump reaches 6.2.108 — added a resolutions entry.
• json-repair is capped <0.53.0 by beeai-framework (still true in its latest, 0.1.82), so a constraint cannot lift it — used override-dependencies. Safe to force: beeai's only call site is json_repair.loads(input, stream_stable=...) in backend/utils.py, it never passes schema= (the vulnerable resolver), and that signature is unchanged in 0.63.2.

Not fixable: alert 1263, cryptography in genai-engine

presidio-anonymizer 2.2.364 — the latest — requires cryptography>=48.0.1,<49.0.0, so 50.0.0 is unreachable here. CVE-2026-69247 is a Bleichenbacher oracle in PKCS#7 EnvelopedData decryption (pkcs7_decrypt_der / _pem / _smime). There is no pkcs7 reference anywhere under genai-engine/src and no endpoint decrypts attacker-supplied EnvelopedData, so the affected code never executes.

Recorded as a not_affected VEX statement for genai-engine-cpu/gpu per security/README.md (document version 7 → 8), with a review date and a note to drop it once presidio widens its pin. ml-engine and the models-* images are already on 50.0.0 and aren't listed.

Also: genai-engine's uv.lock could not be re-resolved at all

uv lock fails outright on dev, which blocks any security relock in genai-engine — that's how this surfaced.

Renovate PRs #2132 and #2134 edited pyproject.toml without relocking, leaving two contradictions:

• openai==3.0.0, forbidden by litellm 1.96.2 (openai>=2.20.0,<3.0.0)
• arthur-common==2.4.69, which itself pins litellm==1.96.0 against pyproject's 1.96.2

CI runs uv sync --frozen, which skips the lock/pyproject consistency check, so this went unnoticed.

Fix: openai back to 2.54.0 — the version the lock already had, so no release ever shipped v3 — plus arthur-common → 2.4.70 (requires litellm 1.96.2) and langchain-openai → 1.5.1 (allows openai<4). Left a comment on the openai pin so the next Renovate bump has context. uv lock --check now passes in all four projects.

Worth a follow-up: Renovate isn't relocking genai-engine, and --frozen hides the drift.

Testing

• genai-engine: 1992 passed, 7 skipped
• model-upload: 9 passed
• observability SDK: ruff + black clean; beeai extra installs, imports, and parse_broken_json works against json-repair 0.63.2
• ml-engine: cryptography 50.0.0 / pyOpenSSL 26.4.0 import cleanly

Not runnable locally, all pre-existing setup reasons: ml-engine and obs-sdk test suites need generated client modules (genai_client, arthur_genai_client), and the UI needs GITLAB_UNIFY_FRONTEND_TOKEN for @arthur/*. The UI lockfile resolves cleanly under --immutable (only the fetch step fails on auth).

Note

Please confirm the UI build in CI. pdfjs-dist 6.1 → 6.2 is a minor bump that overrides a dependency's exact pin, and it's the one change not exercised locally.

🤖 Generated with Claude Code

[alwaysmeticulous]

✅ Meticulous spotted 0 visual differences across 365 screens tested: view results.

Meticulous evaluated ~9 hours of user flows against your PR.

_{Expected differences? Click here. Last updated for commit 22d519e security: clear open Dependabot alerts across all four projects. This comment will update as new commits are pushed.}

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

[github-actions]

Tests	Skipped	Failures	Errors	Time
1999	7 💤	0 ❌	0 🔥	17m 57s ⏱️