v0.0.416

Version 0.0.416 (June 21, 2026)

• Backend dependency management moved from pip to uv (#408) — requirements_versioned.txt is replaced by a PEP 621 pyproject.toml + uv.lock, the Docker build and CI now use uv sync --frozen, and contributors install with uv sync --extra dev (see DEV.md). uv is from the same Astral toolchain as ruff and is significantly faster than pip/Poetry.
• Security — resolved all High/Critical dependency vulnerabilities flagged by Snyk in both the backend (uv) and frontend (yarn) dependency trees.
  • Backend: cryptography 46.0.7 → 49.0.0 (out-of-bounds read) and starlette 0.50.0 → 1.3.1 (SSRF, resource exhaustion, unsafe reflection, request smuggling, incorrectly-resolved name). Resolving Starlette required matching bumps to fastapi (→ 0.138.0), fastapi-mail (→ 1.6.5), and aiosmtplib (→ 5.1.2), which previously capped it. Backend scan now reports 0 issues.
  • Frontend: nuxt → ^3.21.7 (open redirect), vite resolution corrected to >=7.3.5 <8 (directory traversal — the prior resolution pinned the vulnerable 7.3.3), and a new ws resolution >=8.21.0 (asymmetric resource consumption). Frontend now has 0 High/Critical issues.
• Docs — added docs/snyk-dependency-scanning.md (skill-format guide) covering how to scan the uv backend and yarn frontend with the Snyk CLI and apply fixes.