v1.2.134

A dependency-maintenance release: every runtime and build dependency moved to its current minor, the vitest toolchain moved to 5.0, and the repo's dependency-vulnerability gate is green again after a run of new advisories in transitive packages.

No bot-facing or MCP-client contract changed.

Security

• Cleared six high-severity advisories that had been failing the dependency gate on every branch: fast-uri on the server (host confusion and SSRF via scheme, IPv6, and percent-decoding normalization) and browserslist in the UI (unbounded cache growth, and an uncaught crash via untrusted custom stats). Two moderate hono and qs advisories cleared in the same pass.
• All six were reachable only as transitive dependencies and all were fixable in place, so no direct dependency was pinned forward and nothing was added to the audit allowlist — it remains empty.

Build & Tests

• axios 1.19 to 1.20, express-rate-limit 8.6 to 8.7, and zod 4.4 to 4.6 on the server.
• React and React DOM 19.2 to 19.3, react-router-dom 7.18.3, and react-window 2.3.1 in the UI.
• Vite 8.2.1 to 8.3 and @vitejs/plugin-react 6.0.5 to 6.1.1.
• Vitest and @vitest/coverage-v8 4.1 to 5.0 across both packages. The two are version-locked peers, so they moved together; no test or config change was needed and all 1,066 tests pass unmodified.
• ESLint 10.8 to 10.10, typescript-eslint 8.66 to 8.70, globals 17.9 to 17.12, and the @types/pg, @types/react, @testing-library and user-event packages to their current minors.