fix(deps): Patchwatch security floors for tqdm/idna/vitest (v0.55.1)

Clears Patchwatch advisories #36–#40 on the OHM deployment (affecting
ohm-rfc-app + rfc-app-ppe) by forcing the vulnerable dependencies to
patched versions:

- backend/requirements.txt: floor-pin tqdm>=4.66.3 (#37/#39/#40, resolves
  4.68.2) and idna>=3.15 (#38, resolves 3.18) — both arrive transitively
  with no lockfile, so a floor-pin is the robust fix.
- frontend/package.json: vitest ^3.0.0 -> ^4.1.0 (#36, resolves 4.1.8;
  dev/test-only, GHSA-5xrq-8626-4rwp UI-server file read/exec). Lockfile
  regenerated.

No behavior change; backend (685), frontend (66), and localhost E2E (5)
suites pass. Issues are closed after the change is deployed and re-scanned,
not on merge. Patchwatch Phase 2 remediation, session ohm/0095.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -23,6 +23,32 @@ skip versions are the composition of each intervening adjacent
 release's steps in order — no A-to-B path is pre-computed beyond
 that.
 
+## 0.55.1 — 2026-06-09
+
+**Patch — Patchwatch dependency security floors (no behavior change).**
+
+Clears the open Patchwatch advisories on the OHM deployment
+(`ben.stull/rfc-app` issues #36–#40, affecting `ohm-rfc-app` + `rfc-app-ppe`)
+by forcing the vulnerable dependencies up to patched versions. No application
+behavior changes; the full backend (685), frontend (66), and localhost E2E (5)
+suites pass unchanged.
+
+- **Backend transitive floors** (`backend/requirements.txt`). `tqdm` and `idna`
+  arrive transitively (no lockfile; loose `>=`), so floor-pins force the
+  resolved environment to the patched versions on the next deploy:
+  - `tqdm>=4.66.3` — GHSA-r7q7-xcjw-qx8q, GHSA-g7vv-2v7x-gj9p, PYSEC-2017-74
+    (issues #37, #39, #40). Resolves to 4.68.2.
+  - `idna>=3.15` — GHSA-65pc-fj4g-8rjx, the CVE-2024-3651 `idna.encode()`
+    bypass (issue #38). Resolves to 3.18.
+- **Frontend devDependency** (`frontend/package.json`). `vitest ^3.0.0 → ^4.1.0`
+  (resolves to 4.1.8), clearing GHSA-5xrq-8626-4rwp — the Vitest UI server
+  arbitrary file read/execute (issue #36, `node-app` layer). Dev/test-only;
+  not shipped in the runtime image. `package-lock.json` regenerated.
+
+No upgrade steps — a deployment picks up the patched versions on its next
+`flotilla-core deploy` (the backend env is reinstalled from `requirements.txt`;
+the frontend is rebuilt from the regenerated lockfile).
+
 ## 0.55.0 — 2026-06-09
 
 **Minor — the registry reconcile now prunes projects the registry no longer

VERSION

@@ -1 +1 @@
-0.55.0
+0.55.1

backend/requirements.txt

@@ -9,3 +9,11 @@ google-generativeai>=0.8
 openai>=1.50
 PyYAML>=6.0
 bcrypt>=4.2
+
+# Transitive-dependency security floors (Patchwatch #37/#38/#39/#40).
+# tqdm and idna arrive transitively; these floor-pins force resolution to
+# the patched versions so the deployed environment clears the advisories.
+# tqdm>=4.66.3 covers GHSA-r7q7-xcjw-qx8q, GHSA-g7vv-2v7x-gj9p, PYSEC-2017-74.
+# idna>=3.15 covers GHSA-65pc-fj4g-8rjx (CVE-2024-3651 bypass).
+tqdm>=4.66.3
+idna>=3.15

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rfc-app-frontend",
   "private": true,
-  "version": "0.55.0",
+  "version": "0.55.1",
   "type": "module",
   "scripts": {
     "dev": "vite",
@@ -36,6 +36,6 @@
     "@vitejs/plugin-react": "^6.0.1",
     "jsdom": "^25.0.0",
     "vite": "^8.0.12",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.0"
   }
 }