fix(deps): remediate 39 Dependabot alerts across server, dashboard, bridges

[thewrz]

This was written agentically; verify its assertions and edit accordingly:

Why

39 open Dependabot alerts (30 high / 9 medium) against a stack that is live on
api.wrzdj.com / app.wrzdj.com and publishes Docker images others consume.
This clears all 39 without a feature regression, and does so with versions that
have had real community soak time rather than same-day publishes.

What

Server (ghcr.io/wrzonance/wrzdj-api)

• Pillow 12.2.0 → 12.3.0 — clears a 13-CVE cluster. This is the only group
  with a genuinely reachable memory-safety bug: banner.py calls
  Image.open() + .load() before checking img.format against its
  JPEG/PNG/GIF/WEBP allowlist, so attacker bytes reach the EPS / GD / PDF /
  JPEG2000 decoders no matter what the allowlist says. Image.paste() then
  runs on attacker-controlled dimensions (GHSA-6r8x-57c9-28j4, heap OOB write).
  Mitigated in practice by get_owned_event (approved DJ + event owner),
  10/minute rate limit, 5 MB cap, and MAX_IMAGE_PIXELS = 25M.
• pyasn1 0.6.3 → 0.6.4 — decoder DoS. Nothing in the venv imports pyasn1; it
  exists only as a floor pin from an older audit. Hygiene, not exposure.

Dashboard (ghcr.io/wrzonance/wrzdj-web)

• next 16.2.6 → 16.2.11 — clears 9 CVEs. Most are not reachable in this
  app's configuration (no middleware, no Server Actions, no rewrites, no
  Turbopack), but it is a patch bump with no API change.
• sharp → 0.35.3 — next/image is unused in app code, but sharp is
  traced into .next/standalone, so it ships in the published image and
  /_next/image is still mounted. Worth fixing.
• postcss / js-yaml / brace-expansion pinned to patched versions. None of
  the three appear in .next/standalone — they are build tooling.

Bridge / bridge-app

• tar → 7.5.21 — takes npm audit from 28 findings (23 critical) to 5, none
  critical, by clearing a fan-out through the electron-forge chain.
• fast-uri → 3.1.4, postcss → 8.5.18, brace-expansion floors raised.

Why exact pins instead of carets

The security entries in overrides are pinned exactly. With carets, npm
resolved js-yaml@4.3.1 (published that day), brace-expansion@1.1.18/2.1.4/5.0.9
(1 day), and postcss@8.5.25 (2 days) — the exact window where a compromised
publish has not yet been caught. Every version pinned here is 10–51 days old;
next, postcss and sharp additionally carry SLSA provenance attestations.

Testing

• Backend: ruff check + ruff format --check clean, bandit clean
• Backend: pytest — 3394 passed, coverage 89.50% (gate 85%)
• Backend: the 32 failures are pre-existing and environmental — reproduced
  identically on Pillow 12.2.0 / pyasn1 0.6.3, caused by the local repo-root
  .env setting DEV_AUTH_BYPASS=true (absent in CI). test_banner.py
  passes 18/18 on the new Pillow.
• Dashboard: npm run build succeeds, eslint clean, tsc --noEmit clean,
  vitest 1444 passed (109 files)
• Bridge: tsc --noEmit clean, vitest 352 passed (16 files)
• Bridge-app: tsc --noEmit clean, vitest 78 passed (8 files)
• CI green — all 10 checks pass (Backend Tests green in CI, independently confirming the 32 local failures are .env-driven)
• Manual verification: upload an event banner (JPEG + PNG) and confirm the
  WebP banner, kiosk variant, and dominant colours still render

Known follow-ups (deliberately not in this PR)

• brace-expansion CVE-2026-14257 needs 1.1.17 / 2.1.3 / 5.0.8, all published
  1–3 days ago. Dev-scope only and DoS-only; revisit once aged.
• ip SSRF has no fixed version in any release; the existing override is the
  ceiling available.

🤖 Co-authored by Claude Opus 5. Closes #581.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 753bd230-b25d-49bc-b56d-65cc9124b364

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}