horo-next-webui 0.52.544 (upstream v0.52.544)

Python dependency floors

• cryptography floor raised 42.0 → 50.0.0 (15 advisories at 42.0: GHSA-537c-gmf6-5ccf, GHSA-6vqw-3v5j-54x4, GHSA-79v4-65xg-pq4g, GHSA-9v9h-cgj8-h64p, GHSA-h4gh-qq45-vh27, GHSA-jwv3-5hgf-82ww…)

Front-end libraries (served from the wheel)

• mermaid: 10.9.3 → 11.16.1, fixes GHSA-2v8p-3f2j-5mp7, GHSA-6m6c-36f7-fhxh, GHSA-6x64-9x62-f2gx, GHSA-7rqq-prvp-x9jh, GHSA-87f9-hvmw-gh4p, GHSA-c4c3-pg64-4m4v, GHSA-ghcm-xqfw-q4vr, GHSA-xcj9-5m2h-648r, sonatype:CVE-2025-54881, sonatype:CVE-2026-41148, sonatype:CVE-2026-41149, sonatype:CVE-2026-41150, sonatype:CVE-2026-41159, sonatype:CVE-2026-71436, sonatype:CVE-2026-71438 (rebuilt with esbuild, 1 references)
• pdfjs-dist: 4.9.155 → 6.2.108, fixes sonatype:CVE-2026-16633 (self-hosted, 2 files, 2 references)
• prismjs: 1.29.0 → 1.30.0, fixes GHSA-x7hr-w5r2-h6wg, sonatype:CVE-2024-53382 (self-hosted, 600 files, 5 references)
• xterm: 5.3.0, no advisory (self-hosted, 2 files, 2 references)
• xterm-addon-fit: 0.8.0, no advisory (self-hosted, 1 files, 1 references)
• xterm-addon-web-links: 0.9.0, no advisory (self-hosted, 1 files, 1 references)
• js-yaml: 4.1.0 → 4.3.2, fixes GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m, sonatype:CVE-2025-64718, sonatype:CVE-2026-59869, sonatype:CVE-2026-53550, sonatype:CVE-2026-84375 (replaced in static/vendor, 1 references)
• katex: 0.16.22 → 0.18.2, fixes GHSA-238p-pmpm-9mq7, sonatype:CVE-2026-103923 (replaced in static/vendor, 4 references)
• streaming-markdown: 0.2.15, no advisory (vendored upstream)

Shipped-component audit — OSV and Sonatype

Shipped components: 4 Python (Linux / 3.12), 67 npm — OSV and Sonatype: 0 with findings