security(deps): triage remaining medium and low Dependabot alerts

[meiiie]

Objective

After high-severity dependency alerts are resolved in #127, triage and batch the remaining open Dependabot alerts without creating noisy one-off PRs.

Current Count Checked

As of 2026-04-27 via GitHub Dependabot API:

• Medium: 16 open alerts
• Low: 4 open alerts

Acceptance Criteria

• Group alerts by ecosystem and manifest.
• Separate safe patch/minor lockfile-only updates from major migration work.
• Open small dependency PRs with exact verification commands and no unrelated runtime changes.
• Close or document each alert's disposition.

Suggested Order

1. npm/Tauri frontend build-chain alerts that can be cleared by lockfile refresh.
2. Rust/Tauri transitive alerts after security(deps): remediate high Dependabot alerts in desktop/Tauri stack #127 is complete.
3. Python/backend alerts only after confirming they do not conflict with planned provider/orchestration work.

Coordination Notes

• Do not start this until PR chore: harden GitHub security gates #126 is merged and security(deps): remediate high Dependabot alerts in desktop/Tauri stack #127 is underway or complete.
• Keep this separate from secret rotation issue security(secrets): rotate and resolve historical OpenRouter secret-scanning alerts #128.

[meiiie]

Dependency remediation status update after today's pass:

• Merged chore(deps-dev)(deps-dev): bump postcss from 8.5.10 to 8.5.12 in /wiii-desktop in the dev-tools group across 1 directory #131: postcss 8.5.10 -> 8.5.12.
• Merged chore(deps)(deps): bump @rive-app/react-webgl2 from 4.28.1 to 4.28.2 in /wiii-desktop #132: @rive-app/react-webgl2 4.28.1 -> 4.28.2.
• Merged chore(deps)(deps): update lxml requirement from >=5.0.0 to >=6.1.0 in /maritime-ai-service #133: lxml >=5.0.0 -> >=6.1.0.
• Merged chore(deps)(deps): update psycopg requirement from <4.0.0,>=3.1.0 to >=3.3.3,<4.0.0 in /maritime-ai-service #134: psycopg >=3.1,<4 -> >=3.3.3,<4.
• Merged chore(deps)(deps): bump protocol-buffers-schema from 3.6.0 to 3.6.1 in /wiii-desktop #135: protocol-buffers-schema 3.6.0 -> 3.6.1.
• Closed chore(deps-dev)(deps-dev): bump vite, @vitest/coverage-v8 and vitest in /wiii-desktop #136 without merge because it failed npm ci due to Vite 8 peer incompatibility with @vitejs/plugin-react@4.7.0.
• Opened replacement PR chore(deps): upgrade desktop Vite and Vitest stack #144 with the full compatible desktop Vite/Vitest stack. Local validation passed: npm ci, targeted widget test, full Vitest suite, npm run build, npm run build:embed, and git diff --check.

Remaining known audit items from the replacement branch: npm audit --json still reports 4 moderate advisories through dompurify/monaco-editor and uuid/mermaid. I did not auto-apply the suggested fix because the mermaid path is semver-major/non-trivial and should be handled as a separate compatibility review after #144 lands.

[meiiie]

Follow-up on the Vite/Vitest replacement track:

• chore(deps): upgrade desktop Vite and Vitest stack #144 now includes the CI fix for Vitest 4 coverage reporting.
• GitHub required checks are green: Gate Summary, CodeRabbit, Desktop Gate, test, build-embed, CodeQL, repository hygiene, and governance.
• Auto-merge is enabled; the remaining merge blocker is the normal required review from wiiiii123.
• Opened test(desktop): ratchet coverage thresholds after Vitest 4 migration #145 to track raising desktop coverage thresholds after the Vitest 4 migration, so the recalibrated baseline in chore(deps): upgrade desktop Vite and Vitest stack #144 is not treated as the long-term quality target.

[meiiie]

Opened PR #146 for the remaining desktop dependency-alert cleanup.

What this PR handles:

• npm: upgrades direct uuid to 14.0.0, removes obsolete @types/uuid, and uses overrides to force vulnerable transitive dompurify/uuid paths onto patched versions.
• Rust: updates lockfile rand 0.9.2 -> 0.9.3 and rand 0.8.5 -> 0.8.6.
• Validation already run locally: npm ci, npm audit --json, full desktop Vitest run, desktop builds, cargo check --locked, and targeted cargo tree checks.

Important residual item:

• The glib Dependabot alert remains upstream-blocked by the current Tauri/GTK dependency chain (gtk v0.18.2 requires glib ^0.18). Forcing glib 0.20.0 is not compatible with the current graph, so this should stay tracked separately until the upstream Tauri/GTK stack can move.

[meiiie]

Post-merge status after PR #146:

Remaining open Dependabot alerts are now down to:

• chore(deps)(deps): bump the observability group in /maritime-ai-service with 5 updates #19 glib (>=0.15.0,<0.20.0, patched 0.20.0) — upstream-blocked by the current Tauri/GTK stack. gtk v0.18.2 requires glib ^0.18, so forcing glib 0.20.0 is not compatible.
• chore + refactor: CI stabilization + multi-agent routing polish + tier refinement #25 rand (>=0.7.0,<0.8.6, patched 0.8.6) — the remaining vulnerable instance is rand 0.7.3 through a build-time upstream chain: tauri-utils/wry -> kuchikiki-speedreader -> selectors -> phf_codegen -> phf_generator -> rand.

Additional verification:

• cargo tree -i rand@0.8.5 --locked no longer matches any packages.
• cargo tree -i rand@0.9.2 --locked no longer matches any packages.
• cargo tree -i rand@0.7.3 --locked still resolves only through the upstream build-dependency chain above.
• Tried compatible wry patch updates (0.54.2, 0.54.4) in a throwaway branch; they do not remove rand 0.7.3, so no useful lockfile commit should be made for this path.

Recommended handling:

• Keep chore(deps)(deps): bump the observability group in /maritime-ai-service with 5 updates #19 open/tracked until Tauri/GTK can move to a compatible glib >=0.20 line.
• Treat chore + refactor: CI stabilization + multi-agent routing polish + tier refinement #25 as upstream/build-dependency residual. It is reasonable to dismiss as tolerable_risk with this justification if the team wants the Dependabot dashboard to reflect actionable runtime risk only.

[meiiie]

Follow-up: dismissed Dependabot #25 (rand >=0.7,<0.8.6) as tolerable_risk with justification after verification. The remaining path is an upstream build-time residual through the Tauri/wry/kuchikiki-speedreader chain; compatible patch updates do not remove it.

Current Dependabot open state after PR #146 + #25 dismissal:

• Only chore(deps)(deps): bump the observability group in /maritime-ai-service with 5 updates #19 glib remains open.

Recommendation: keep #129 open for #19 until the Tauri/GTK stack can move from glib ^0.18 to a compatible glib >=0.20 line.