v1.8.0

A dependency security release: it clears every open Dependabot alert. There are no functional changes.

pip install minilake==1.8.0
docker pull ghcr.io/dmux/minilake:1.8.0

Security

All of these are transitive dependencies of the web UI, fixed with a lockfile-only refresh of ui/pnpm-lock.yaml. Each patched version already fits the range its parent declares, so ui/package.json is unchanged and no overrides were needed.

Package	Before	After	Advisories
fast-uri	3.1.5	3.1.8	4 high: host confusion and SSRF via URI normalization
js-yaml	4.3.1	4.3.2	1 high: merge-key CPU exhaustion
hono	4.13.3	4.13.11	3 medium: toSSG() path escape, parseBody() memory exhaustion, fragment query parsing
qs	6.15.3	6.16.0	2 medium: DoS via isBuffer, array-limit bypass
undici	7.29.0	7.30.0	1 medium: WebSocket permessage-deflate DoS
ip-address	10.5.0	10.7.2	2 medium: link-local / NAT64 classification bypass

Exposure was low. These packages come in through shadcn (its MCP SDK, express and ajv) and eslint, not through the exported UI bundle that ships in the wheel. pnpm audit now reports no known vulnerabilities.

Per-release detail lives in CHANGELOG.md.

---

What's Changed

• chore(release): 1.8.0 — fix open Dependabot alerts by @dmux in #21

Full Changelog: v1.7.8...v1.8.0

• PyPI: https://pypi.org/project/minilake/1.8.0/
• Container image: ghcr.io/dmux/minilake:1.8.0