fix: address open Dependabot security alerts

[cbullinger]

Summary

This PR upgrades vulnerable transitive dependencies to address all 16 open Dependabot security alerts on main.

Changes

JavaScript (frameworks/javascript/tanstack)

Package	Override	Lockfile change	Via
fast-uri	>=4.1.2	3.1.2 → 4.1.2	ajv / bluehawk
js-yaml	>=5.2.2	5.2.1 → 5.2.2	xmlbuilder2
nanoid	>=3.3.18	3.3.17 → 3.3.18	postcss
postcss	>=8.5.23	8.5.15 → 8.5.25	transitive
undici	>=8.9.0	8.5.0 → 8.10.0	jsdom

Python (mflix/server/python-fastapi)

Package	Constraint	Lockfile change
aiohttp	>=3.14.3	3.14.1 → 3.14.3

Security Issues Addressed

High Severity

• GHSA-pm4m-ph32-ghv5: js-yaml exponential parsing time in flow collections leads to denial of service (CVSS 7.5)
• GHSA-r28c-9q8g-f849: PostCSS path traversal in source map auto-loading (CVSS 7.5)
• GHSA-6g55-p6wh-862q: PostCSS incomplete fix — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset
• GHSA-4c8g-83qw-93j6: fast-uri host confusion via failed IDN canonicalization (CVSS 7.5)
• GHSA-v2hh-gcrm-f6hx: fast-uri host confusion via literal backslash authority delimiter (CVSS 7.5)
• GHSA-7p8r-x3mc-p8w7: fast-uri host confusion via backslash authority introducer (4.x line)
• CVE-2026-13697 (GHSA-4cwx-7wf7-3272): undici cross-user information disclosure via degenerate private cache directives (CVSS 7.4)
• CVE-2026-69244 (GHSA-cq5v-8q36-5273): aiohttp out-of-bounds heap read in C HTTP response parser (CVSS high)
• CVE-2026-67214 (GHSA-28wg-ghj8-5hjv): nanoid non-secure generators can loop indefinitely with negative size
• CVE-2026-67213 (GHSA-2v37-7h3g-55p8): nanoid custom generators can loop indefinitely when size is zero

Medium Severity

• CVE-2026-59881 (GHSA-mq44-7p77-q5h7): aiohttp WebSocket client accepts compressed frames without negotiated permessage-deflate
• CVE-2026-69243 (GHSA-m8rv-5g2x-5cg5): aiohttp HTTP request smuggling via WebSocket upgrade
• CVE-2026-15157 (GHSA-m8rv-5g2x-5cg5): undici CRLF injection via blob-like body type property (CVSS 4.2)
• CVE-2026-14643 (GHSA-jr45-8vmc-qm54): undici cross-user information disclosure via Cache-Control whitespace (CVSS 5.9)
• CVE-2026-16729 (GHSA-v3r7-h72x-cjcm): undici cookie attribute injection (CVSS 4.8)
• CVE-2026-16728 (GHSA-8xcm-r25x-g524): undici downstream response desynchronization via retry interceptor (CVSS 4.8)

Dependabot Alerts Resolved

Closes #117, #118, #119, #120, #121, #122, #123, #124, #125, #126, #127, #128, #129, #130, #132, #133

Test Plan

• npm audit reports 0 vulnerabilities in tanstack app and bluehawk package
• Lockfiles reflect patched versions for all affected packages
• requirements.txt regenerated with aiohttp >=3.14.3
• Unit tests pass (npm test in tanstack app)
• CI passes
• No breaking changes in application functionality

[tmcneil-mdb]

LGTM! Would add the nanoid 3.3.18, to grab the other dependabots as well.
Edit: NVM! Too fast. 😂