v14.1.1 - Dependency Security

Security

• Vendored axios 1.21.0, Vue 3.5.44, Vuetify 4.3.1 and Tabler icons 3.50.0, now fetched by ./vendor.sh. Tabler ships its font as subsets in static/tabler/fonts/, so pages load only the icon groups they use.
• Werkzeug's minimum is 3.1.9 (PYSEC-2026-4312), and the locked dependencies, including dev tools, are updated (flask-security-too 5.9.2, sqlalchemy 2.1.6, wtforms 3.3.1, python-dateutil 3.0.0).
• CI audits the locked dependencies for known vulnerabilities with uv audit.