[pacphi]

Summary

Consolidates 12 of the 14 open Dependabot PRs into a single branch, applying every bump as latest-compatible-within-major (manifests updated directly, lockfiles regenerated once), then runs a full ecosystem security audit and fixes three Rust advisories that had been deferred in prior consolidations because their blocking upstream constraint has since resolved.

Superseded PRs

PR	Package	Bump	Area
#153	js-yaml	5.2.3 → 5.4.2	TS (frontend)
#152	taiki-e/install-action	v2.86.3 → v2.87.19	GitHub Actions
#149	vitest	4.1.10 → 4.1.11	TS (frontend)
#147	react-dropzone	15.0.0 → 20.1.2	TS (frontend)
#146	@vitejs/plugin-react	6.0.5 → 6.1.1	TS (frontend)
#145	zustand	5.0.14 → 5.0.15	TS (frontend)
#144	@types/react-dom	19.2.3 → 19.3.0	TS (frontend)
#143	quick-xml	0.41.0 → 0.42.0	Rust (workspace)
#142	http	1.4.1 → 1.5.0	Rust (lockfile only; manifest already "1")
#141	rand	0.10.1 → 0.10.3	Rust (lockfile only; manifest already "0.10")
#139	rust (Docker)	1.97-bookworm → 1.98-bookworm	Dockerfile.backend

react-dropzone 15 → 20 (5 majors) — risk assessment

Dependabot proposed a 5-major jump because 15.0.0 was the last 15.x release (same shape as the deferred @tanstack/react-table bump). Reviewed every intervening major's breaking-change notes against this repo's one call site (frontend/src/components/upload/FileUpload.tsx):

• v16 (ESM/CJS split): no deep imports used, bundler-resolved — unaffected.
• v17 (React ≥18 required): already on React 19.2.8 — unaffected.
• v18 (FileWithPath requires path/relativePath): onDrop already typed as File[], not FileWithPath[] — unaffected.
• v19 (accept-up-to-maxFiles instead of rejecting the whole batch): a real behavior change, but this component sets maxFiles: 1 and never reads fileRejections — no observable difference.
• v20 (Node ≥22 at build time): engines.node is already >=24 — unaffected.

Applied the bump; frontend lint/typecheck/test/build all green.

Deferred (left open — not applied)

PR	Package	Bump	Reason
#136	@tanstack/react-table	8.21.0 → 9.1.2	8.21.3 is still the latest published 8.x release (confirmed via npm registry) — this is a major-version rewrite, not a routine bump. Same deferral as the last two consolidations (#127, #138).
#116	candle-core	0.10.2 → 0.11.0	Still blocked — see below.
#126	candle-transformers	0.10.2 → 0.11.0	Still blocked — see below.

Why #116/#126 are still blocked: confirmed via the crates.io API that mistralrs's latest published release is still 0.8.1, and it still hard-pins candle-core = "^0.10.2" / candle-nn = "^0.10.2". Bumping our own candle-core/candle-nn/candle-transformers to 0.11 would create duplicate builds of the candle crates (0.10.2 for mistralrs, 0.11.0 for finima-embed/finima-llm's direct use) — exactly what the existing Cargo.toml pin comment says it exists to prevent. Unchanged from #127/#138; needs a mistralrs release that adopts candle 0.11.

Security audit

Ran cargo audit (via the CI's exact .github/scripts/cargo-audit.sh gate), pnpm audit, and checked gh api repos/pacphi/finima/dependabot/alerts.

Rust (cargo audit)

Advisory	Package	Severity	Resolution
RUSTSEC-2026-0285	rustls 0.23.40 (TLS 1.3 handshake messages accepted across encryption-level boundaries)	Medium	Fixed. In-range, lockfile-only: cargo update -p rustls --precise 0.23.45.
RUSTSEC-2026-0253	lru 0.16.4 (use-after-free risk in LruCache::pop() under panic)	—	Fixed — previously deferred. aws-sdk-s3's newest release (1.152.0, up from the 1.132.0 we had) now depends on lru ^0.18.2. Bumped (cargo update -p aws-sdk-s3 --precise 1.152.0, in-range for the workspace's "1" constraint, lockfile-only). Removed the now-stale ignore entry from audit-ignore and .cargo/audit.toml.
RUSTSEC-2026-0235	rkyv 0.7.46 (OOB reads via Rc/Arc, reachable only through rust_decimal's unused rkyv feature)	—	Fixed — previously deferred. rust_decimal's newest release (1.43.0, up from 1.42.1) depends on rkyv ^0.8.13 instead of the vulnerable 0.7 line. Bumped (in-range for "1", lockfile-only) — rkyv 0.7.46 and its whole transitive cluster (bytecheck, ptr_meta, seahash, etc.) drop out of the tree entirely. Removed the ignore entry from both files.

audit-ignore / .cargo/audit.toml exceptions: down from 9 to 7 documented, all re-verified still non-actionable (sqlx-mysql-only rsa, compiled-out rand log path, and five unmaintained-informational transitive deps with no drop-in replacement).

Frontend (pnpm audit + Dependabot)

All 12 currently-open GitHub Dependabot alerts on frontend/pnpm-lock.yaml are resolved:

Advisory	Package	Resolution
GHSA-r3ph-w7gj-g6xm	js-yaml	Resolved by the js-yaml 5.4.1→5.4.2 bump above (patched in 5.4.1).
N/A (GHSA-82fw-gwwq-j7x9)	vitest / @vitest/mocker	Resolved by the vitest 4.1.11 bump above (first patched version).
6 × undici advisories (GHSA-3wwx-…, -pmjh-…, -r53p-…, -rfgv-…, -3xpg-…, -2jfj-…, -2gqq-…, -w293-…, -8436-…, -rx4f-…)	undici (dev-only, via jsdom/vitest)	New pnpm override: undici@<8.10.2: ">=8.10.2".
GHSA-c83g-rgw3-j3cx, GHSA-73wf-gq98-2v4g	browserslist (dev-only, via eslint-plugin-react-hooks → @babel/core)	New pnpm override: browserslist@<4.28.7: ">=4.28.7".
GHSA-w5vr-8v7q-w6rv	baseline-browser-mapping (dev-only, transitive via browserslist)	New pnpm override: baseline-browser-mapping@<2.11.0: ">=2.11.0".
GHSA-p498-v437-472g	@humanfs/node (dev-only, via eslint)	New pnpm override: @humanfs/node@<0.16.8: ">=0.16.8".

Also widened the existing brace-expansion override (>=4.0.0 <5.0.9 → >=5.0.9) to >=4.0.0 <5.0.12 → >=5.0.12, since three newer brace-expansion advisories (GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p) had been published above the old floor.

pnpm audit: 0 known vulnerabilities (was 17 — all dev/test-only transitive, none in the production bundle).

Pre-existing fixes

clippy::double_must_use on six #[async_trait] trait definitions (EmbeddingProvider, UserRepo, PortfolioRepo, AccountRepo, LlmClient, EmailSender). GitHub's dtolnay/rust-toolchain@stable runner advanced to Rust 1.99.0 between the last green run on main (2026-09-29) and this PR's CI run, which introduced this new clippy lint. It fires on every #[async_trait]-decorated trait definition (not impl blocks) because async_trait's generated method wrapper carries a redundant #[must_use] on top of the already-must_use Result/Future return type — a known async_trait/clippy interaction, not a defect in these traits. Confirmed unrelated to this PR's dependency bumps by updating rustup's local stable toolchain to 1.99.0 and reproducing against main's unmodified HEAD — it fails identically. Fixed with the exact attribute clippy's own diagnostic suggests: #[allow(clippy::double_must_use)] on each trait declaration, rather than touching the macro-generated code. Re-verified green: cargo fmt --all -- --check, cargo clippy --workspace --all-targets --keep-going -- -D warnings, cargo test --workspace (29/29 suites) on rustc 1.99.0.

Otherwise none needed — cargo fmt, cargo clippy, and the full cargo test --workspace suite were already green on main before these bumps (as of the pre-1.99.0 toolchain).

One upgrade note for visibility (not a fix): bumping the workspace's own quick-xml to 0.42 creates a duplicate build alongside quick-xml 0.41, which calamine 0.36.1 and feed-rs 2.4.0 both still pin via ^0.41. Confirmed via cargo tree -i quick-xml@0.41.0. Unlike the documented candle/mistralrs duplicate-build concern, this is a small pure-Rust XML crate — negligible compile-time/binary-size cost, not worth blocking the bump over.

Verification

All commands mirror .github/workflows/ci.yml and .github/scripts/cargo-audit.sh exactly.

Backend:

cargo fmt --all -- --check                                    # pass
cargo clippy --workspace --all-targets -- -D warnings         # pass, 0 warnings
cargo test --workspace                                         # pass, 29/29 suites (incl. DB integration tests via docker-compose.test.yml)
bash .github/scripts/cargo-audit.sh                             # pass, 7 documented exceptions (down from 9)

Frontend:

pnpm install --frozen-lockfile   # pass, reproduces lockfile
pnpm run lint                    # pass
pnpm exec tsc --noEmit           # pass
pnpm exec prettier --check 'src/**/*.{ts,tsx,css}'  # pass
pnpm run test -- --run           # pass (9/9 tests)
pnpm run build                   # pass (pre-existing >500kB chunk warning, unrelated)
pnpm audit                       # pass, 0 known vulnerabilities

🤖 Generated with Claude Code

[pacphi]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.