fix(deps): Patchwatch security floors for tqdm/idna/vitest (v0.55.1)
Clears Patchwatch advisories #36–#40 on the OHM deployment (affecting ohm-rfc-app + rfc-app-ppe) by forcing the vulnerable dependencies to patched versions: - backend/requirements.txt: floor-pin tqdm>=4.66.3 (#37/#39/#40, resolves 4.68.2) and idna>=3.15 (#38, resolves 3.18) — both arrive transitively with no lockfile, so a floor-pin is the robust fix. - frontend/package.json: vitest ^3.0.0 -> ^4.1.0 (#36, resolves 4.1.8; dev/test-only, GHSA-5xrq-8626-4rwp UI-server file read/exec). Lockfile regenerated. No behavior change; backend (685), frontend (66), and localhost E2E (5) suites pass. Issues are closed after the change is deployed and re-scanned, not on merge. Patchwatch Phase 2 remediation, session ohm/0095. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ben Stull