Clear open Dependabot alerts with a single dependency bump PR

## Summary Dependabot currently shows **32 open alerts** on `uniz-rguktong/uniz-master`. We want **one fresh PR** that upgrades (or overrides) the affected packages so these alerts go green — not 32 separate Dependabot PRs if we can avoid that. Security tab: https://github.com/uniz-rguktong/uniz-master/security/dependabot Last scan was a couple weeks ago; please re-check alerts after the bump. ## Goal - Resolve **all currently open Dependabot alerts** in one PR (or as few PRs as lockfile split requires: npm vs python) - Prefer patched versions over `npm audit --force` - Keep the app building (`npm run build:shared && npm run ci:build`, portal build, landing-backend if uv.lock changes) - No secrets, no unrelated refactors ## Manifests | Lock / manifest | Ecosystem | |-----------------|-----------| | `package-lock.json` (repo root, workspaces) | npm | | `apps/uniz-portal/package.json` | npm (react-router) | | `apps/uniz-user/package.json` | npm (sharp) | | `apps/uniz-landing-backend/uv.lock` | pip (`cryptography`) | Root `package.json` already has an `overrides` block — extend that when a transitive dep needs a pin and we can't bump the parent yet. ## Open alerts (grouped) ### Critical / high — npm (`package-lock.json` unless noted) | Package | What Dependabot flagged | |---------|-------------------------| | `tar` / node-tar | decompression DoS, negative size infinite loop, recursion/stack overflow, PAX path crash (#649, #648, #660, #650) | | `brace-expansion` | several DoS paths (#644, #659, #661, #665) | | `js-yaml` | quadratic CPU on merge keys / `!!omap` (dev) (#654, #678) | | `shell-quote` | quadratic DoS in `parse()` (dev) (#647) | | `ip-address` | SSRF / trust-boundary issues (#667, #664, #663) | | `postcss` | source map path traversal / incomplete GHSA fix (dev) (#662, #670) | | `body-parser` | invalid `limit` disables size cap (#658) | | `react-router` / `react-router-dom` | open redirect, XSS, CSRF/RSC, constructor injection (#651, #653, #652, #656, #657, #677) — also flagged on `apps/uniz-portal/package.json` | | `dompurify` | XSS via detached subtree (#676) | | `mermaid` | prototype pollution, CSS injection, diagram DoS (#671–#675) | | `sharp` | inherited libvips CVEs (#645, #646 on `apps/uniz-user/package.json`) | ### High — pip | Package | Manifest | Notes | |---------|----------|--------| | `cryptography` | `apps/uniz-landing-backend/uv.lock` | PKCS#7 Bleichenbacher-style oracle (#666) | ## Suggested approach 1. Snapshot current alerts (screenshot or `gh api repos/uniz-rguktong/uniz-master/dependabot/alerts?state=open`). 2. **npm:** bump direct deps where we can; use root `overrides` for stubborn transitives (`tar`, `brace-expansion`, `ip-address`, etc.). Run `npm ci` / install so the lockfile is consistent. 3. **uv:** bump `cryptography` in landing-backend and regenerate `uv.lock`. 4. `npm run build:shared && npm run ci:build` and portal build. Don't skip lockfile-only "looks fine" without a build. 5. After merge, confirm Dependabot count dropped (some alerts may need a rescan). ## Acceptance criteria - [ ] One (or two: npm + uv) PR targeting these alerts - [ ] `package-lock.json` / `uv.lock` committed, no leftover vulnerable versions for the listed GHSA/CVEs if a patch exists - [ ] CI green - [ ] Short PR notes: what was bumped vs overridden, and anything that *can't* be patched yet (leave a comment on the alert) ## Want this? Comment below if you want it assigned. Mention if you'll take **npm**, **uv/cryptography**, or **both**.