fix(deps): remediate Dependabot security advisories

[elkaix]

Summary

Clears the open Dependabot advisories (reported as 111: 1 critical / 26 high / 78 moderate / 6 low) across all four manifests. Every change was verified by the affected package's own build/test.

Python (4 advisories → 0)

• asyncssh 2.22.0 → 2.23.0 — path traversal in AuthorizedKeysFile %u. Bumped the pythinker-host pin and re-locked the root workspace + the standalone pythinker-host lockfile.
• starlette 1.0.0 → 1.2.1 — Host-header path poisoning. Bumped via root re-lock.

JavaScript

• web (66 → 9 low): regenerated package-lock.json (package.json already allowed vite ^7 / uuid ^13) + npm audit fix. All critical/high/moderate cleared.
• vis (38 → 0): lockfile regen + npm audit fix.
• install-counter-worker (3 → 0, incl. the critical): vitest ^2.1.9 → ^3.2.6 (Vitest UI arbitrary file read/exec); brings vite/esbuild to patched transitives.

Verification

• Python: pythinker-host pytest 40 passed, tests/core 1137, tests/web+tests/acp 41.
• web: typecheck + build + lint green. vis: typecheck + build green. worker: vitest run 14 passed.

Residual (intentional)

A handful of low-severity transitive elliptic/bn.js advisories in web's browser crypto-polyfill chain (vite-plugin-node-polyfills). The only available fix (npm audit fix --force) downgrades vite-plugin-node-polyfills and majors ai to v6, breaking the build — not worth it for low-severity browser-polyfill advisories. Left for a deliberate, separately-verified bump.

Note

packages/pythinker-host/uv.lock is a vestigial standalone lock (last touched in the initial commit; CI's uv sync --project uses the workspace root lock). Regenerated here purely to clear its Dependabot alert; uv lock --check passes.

Summary by CodeRabbit

• Chores
  • Updated project dependencies to remediate security vulnerabilities in critical packages.
  • Regenerated dependency lockfiles to address transitive dependency advisories.
  • Remaining low-severity transitive advisories noted for future remediation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 07b09dec-d600-47a2-97df-93b6e9217da1

📥 Commits

Reviewing files that changed from the base of the PR and between b6a6350 and 33eeb76.

⛔ Files ignored due to path filters (5)

• packages/install-counter-worker/package-lock.json is excluded by !**/package-lock.json
• packages/pythinker-host/uv.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock
• vis/package-lock.json is excluded by !**/package-lock.json
• web/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

• CHANGELOG.md
• packages/install-counter-worker/package.json
• packages/pythinker-host/pyproject.toml

---

📝 Walkthrough

Walkthrough

This PR addresses security vulnerabilities through targeted dependency updates. The changelog documents remediation of cleared Dependabot advisories with specific Python and JavaScript package version increments, while lockfiles and manifests reflect the pinned versions for asyncssh and vitest.

Changes

Security Dependency Updates

Layer / File(s)	Summary
Dependency version updates and changelog entry CHANGELOG.md, packages/pythinker-host/pyproject.toml, packages/install-counter-worker/package.json	asyncssh upgraded to 2.23.0, vitest dev dependency upgraded to ^3.2.6, and changelog entry documents the cleared advisories with a note on residual low-severity transitive items.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested labels

dependencies

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title follows conventional commits format (fix type, deps scope) and accurately describes the main change: security dependency updates across multiple manifests.
Description check	✅ Passed	Description is comprehensive and covers all critical sections: summary of changes, detailed breakdown by language/package, verification results, residual issues, and notes. Goes beyond template requirements.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependency-security

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!