fix: resolve Dependabot security alerts (#52-75)

frameworks/javascript/tanstack/app/package.json

@@ -20,11 +20,11 @@
     "@tailwindcss/vite": "4.2.2",
     "@tanstack/react-devtools": "0.10.0",
     "@tanstack/react-query": "5.95.2",
-    "@tanstack/react-router": "1.169.2",
-    "@tanstack/react-router-devtools": "1.166.13",
-    "@tanstack/react-router-ssr-query": "1.166.10",
-    "@tanstack/react-start": "1.167.65",
-    "@tanstack/router-plugin": "1.167.35",
+    "@tanstack/react-router": "1.170.8",
+    "@tanstack/react-router-devtools": "1.167.0",
+    "@tanstack/react-router-ssr-query": "1.167.0",
+    "@tanstack/react-start": "1.168.13",
+    "@tanstack/router-plugin": "1.168.11",
     "lucide-react": "0.545.0",
     "mongodb": "7.1.1",
     "react": "19.2.4",
@@ -45,12 +45,19 @@
     "typescript": "5.9.3",
     "vite": "7.3.2",
     "vite-tsconfig-paths": "5.1.4",
-    "vitest": "3.2.4"
+    "vitest": "4.1.8"
   },
   "pnpm": {
     "onlyBuiltDependencies": [
       "esbuild",
       "lightningcss"
     ]
+  },
+  "overrides": {
+    "@tanstack/react-router": "1.170.8",
+    "@tanstack/router-core": "1.171.6",
+    "h3": ">=2.0.1-rc.18",
+    "postcss": ">=8.5.10",
+    "ws": ">=8.20.1"
   }
 }

frameworks/javascript/tanstack/app/vitest.unit.config.ts

@@ -52,6 +52,12 @@ export default defineConfig({
   resolve: {
     alias: {
       '#': resolve(__dirname, './src'),
+      // Replace TanStack's createServerFn with a passthrough so server
+      // functions can be called directly in unit tests without Start context.
+      '@tanstack/react-start': resolve(
+        __dirname,
+        '../tests/integration/tanstack-react-start.mock.ts'
+      ),
     },
   },
 });

frameworks/javascript/tanstack/package.json

@@ -12,6 +12,7 @@
     "prettier": "3.8.3"
   },
   "overrides": {
-    "lodash": "4.18.1"
+    "fast-uri": ">=3.1.2",
+    "lodash": ">=4.18.0"
   }
 }

mflix/server/python-fastapi/requirements.in

@@ -2,8 +2,8 @@
 # 1. CORE WEB FRAMEWORK & ASGI SERVER
 # FastAPI and its main components.
 # ------------------------------------------------------------------------------
-fastapi~=0.120.4        # The main web framework
-starlette~=0.49.3       # FastAPI's underlying ASGI toolkit
+fastapi~=0.136.3        # The main web framework (CVE-2026-48710 / PYSEC-2026-161)
+starlette>=1.0.1        # Host header validation fix (PYSEC-2026-161)
 uvicorn~=0.38.0         # Production-ready ASGI server
 uvloop~=0.22.1          # Optional: High-performance event loop for uvicorn
 websockets~=15.0.1      # For WebSocket support
@@ -15,7 +15,7 @@ watchfiles~=1.1.1       # For hot-reloading in development
 # ------------------------------------------------------------------------------
 pydantic~=2.12.5        # Data validation and settings management
 python-dotenv>=1.2.2    # For loading configuration from .env files (CVE-2026-28684)
-python-multipart>=0.0.27 # For parsing form data and file uploads (CVE-2026-42561)
+python-multipart>=0.0.29 # For parsing form data and file uploads (Dependabot #62)
 PyYAML~=6.0.3           # For handling YAML configuration or data
 
 # ==============================================================================
@@ -32,7 +32,7 @@ dnspython~=2.8.0        # Required for SRV record lookups by pymongo (e.g., Mong
 httpx~=0.28.1           # Asynchronous HTTP client for requests to external APIs
 email-validator~=2.3.0  # Utility for validating email addresses
 voyageai~=0.3.7         # Vector embeddings API client
-urllib3>=2.6.3          # HTTP library
+urllib3>=2.7.0          # HTTP library (Dependabot #66, #67)
 
 # ==============================================================================
 # 5. CLI & DEVELOPMENT TOOLS
@@ -62,11 +62,12 @@ rich-toolkit~=0.15.1    # Extensions for the 'rich' library
 # Minimum versions for indirect dependencies.
 # ------------------------------------------------------------------------------
 filelock>=3.20.3        # Transitive dep via huggingface-hub
-aiohttp>=3.13.4         # Transitive dep via voyageai (CVE-2026-34525)
+aiohttp>=3.14.0         # Transitive dep via voyageai (Dependabot #74, #75)
 orjson>=3.11.7          # Transitive dep via langsmith (CVE fix)
-langchain-core>=1.2.28  # Transitive dep via langchain-text-splitters (CVE-2026-26013, CVE-2026-40087)
-langsmith>=0.7.31       # Transitive dep via langchain (CVE-2026-41182)
+langchain-core>=1.4.0   # Transitive dep via langchain-text-splitters (Dependabot #63)
+langsmith>=0.8.5        # Transitive dep via langchain-core (Dependabot #68)
 langchain-text-splitters>=1.1.2 # Transitive dep via langchain (CVE-2026-41481)
 pygments>=2.20.0        # Transitive dep via rich/pytest (CVE-2026-4539)
 pillow>=12.2.0          # Transitive dep via voyageai (Pillow 12.2.0 security fixes)
 requests>=2.33.0        # Transitive dep via langsmith/voyageai (CVE-2026-25645 fix)
+idna>=3.15              # Transitive dep via httpx/requests (Dependabot #70)

mflix/server/python-fastapi/requirements.txt

@@ -1,100 +1,83 @@
-aiohappyeyeballs==2.6.1
-aiohttp==3.13.5
+#
+# This file is autogenerated by pip-compile with Python 3.13
+# by the following command:
+#
+#    pip-compile --no-annotate --output-file=requirements.txt --strip-extras requirements.in
+#
+aiohappyeyeballs==2.6.2
+aiohttp==3.14.0
 aiolimiter==1.2.1
 aiosignal==1.4.0
 annotated-doc==0.0.4
 annotated-types==0.7.0
-anyio==4.12.1
-attrs==25.4.0
-boolean.py==5.0
-build==1.5.0
-CacheControl==0.14.4
-certifi==2026.1.4
-charset-normalizer==3.4.4
-click==8.3.1
-cyclonedx-python-lib==11.7.0
-defusedxml==0.7.1
+anyio==4.13.0
+attrs==26.1.0
+certifi==2026.5.20
+charset-normalizer==3.4.7
+click==8.4.1
 dnspython==2.8.0
 email-validator==2.3.0
-fastapi==0.120.4
-fastapi-cli==0.0.20
+fastapi==0.136.3
+fastapi-cli==0.0.24
 fastapi-cloud-cli==0.3.1
 ffmpeg-python==0.2.0
-filelock==3.20.3
+filelock==3.29.1
 frozenlist==1.8.0
-fsspec==2026.2.0
+fsspec==2026.4.0
 future==1.0.0
 h11==0.16.0
-hf-xet==1.2.0
+hf-xet==1.5.0
 httpcore==1.0.9
-httptools==0.7.1
+httptools==0.8.0
 httpx==0.28.1
-huggingface_hub==1.4.1
-idna==3.11
+huggingface-hub==1.17.0
+idna==3.18
 iniconfig==2.3.0
 jsonpatch==1.33
-jsonpointer==3.0.0
-langchain-core==1.3.3
-langchain-protocol==0.0.15
+jsonpointer==3.1.1
+langchain-core==1.4.0
+langchain-protocol==0.0.16
 langchain-text-splitters==1.1.2
-langsmith==0.8.3
-license-expression==30.4.4
-markdown-it-py==4.0.0
+langsmith==0.8.9
+markdown-it-py==4.2.0
 mdurl==0.1.2
-msgpack==1.1.2
 multidict==6.7.1
-numpy==2.4.2
-orjson==3.11.7
-packageurl-python==0.17.6
-packaging==26.0
+numpy==2.4.6
+orjson==3.11.9
+packaging==26.2
 pillow==12.2.0
-pip-api==0.0.34
-pip-requirements-parser==32.0.1
-pip-tools==7.5.3
-pip_audit==2.10.0
-platformdirs==4.9.6
 pluggy==1.6.0
-propcache==0.4.1
-py-serializable==2.1.0
+propcache==0.5.2
 pydantic==2.12.5
-pydantic_core==2.41.5
-Pygments==2.20.0
+pydantic-core==2.41.5
+pygments==2.20.0
 pymongo==4.17.0
-pyparsing==3.3.2
-pyproject_hooks==1.2.0
 pytest==9.0.3
 pytest-asyncio==1.3.0
 python-dotenv==1.2.2
-python-multipart==0.0.27
-PyYAML==6.0.3
-requests==2.33.1
+python-multipart==0.0.31
+pyyaml==6.0.3
+requests==2.34.2
 requests-toolbelt==1.0.0
 rich==14.2.0
 rich-toolkit==0.15.1
 rignore==0.7.6
 sentry-sdk==2.42.1
-setuptools==82.0.1
 shellingham==1.5.4
-sniffio==1.3.1
-sortedcontainers==2.4.0
-starlette==0.49.3
-tenacity==9.1.3
-tokenizers==0.22.2
-tomli==2.4.1
-tomli_w==1.2.0
+starlette==1.2.1
+tenacity==9.1.4
+tokenizers==0.23.1
 tqdm==4.67.3
 typer==0.20.1
-typer-slim==0.21.1
+typing-extensions==4.15.0
 typing-inspection==0.4.2
-typing_extensions==4.15.0
-urllib3==2.6.3
-uuid_utils==0.14.0
+urllib3==2.7.0
+uuid-utils==0.16.0
 uvicorn==0.38.0
 uvloop==0.22.1
 voyageai==0.3.7
 watchfiles==1.1.1
 websockets==15.0.1
-wheel==0.47.0
-xxhash==3.6.0
-yarl==1.22.0
+xxhash==3.7.0
+yarl==1.24.2
 zstandard==0.25.0