chore(deps): bump the production-dependencies group in /web with 3 updates

[dependabot]

Bumps the production-dependencies group in /web with 3 updates: jose, marked and sharp.

Updates jose from 6.2.9 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

Commits

• 3eab152 chore(release): 6.2.10
• 021abf4 refactor(jws): specialize compact processing
• a998927 refactor(jwe): specialize compact processing
• eedb124 refactor(jose): share binary input validation
• 52ba159 refactor(jwt): share producer claim state
• 85e30ed refactor(jose): share compact token processing internals
• 0bd81d2 test(jose): cover hidden critical-header options
• 9cf7876 test(jose): reject callable object impostors
• f23cafd test(jose): preserve resolved key data properties
• 1ee6f61 refactor(jwe): consolidate CBC decryption failures
• Additional commits viewable in compare view

Updates marked from 18.0.10 to 18.0.11

Release notes

Sourced from marked's releases.

v18.0.11

18.0.11 (2026-08-24)

Bug Fixes

• do not nest a link inside a link (#4051) (e250e31)
• inlineTokens rebuilds the reflink-mask preamble per call (#4040) (0653c24)
• keep emphasis in the text of a rejected reference link (#4059) (b699db3)

Commits

• 53cb13f chore(release): 18.0.11 [skip ci]
• 0c6b2a6 docs: add adaptable bullet point (#4058)
• c430a64 chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#4069)
• b699db3 fix: keep emphasis in the text of a rejected reference link (#4059)
• 0653c24 fix: inlineTokens rebuilds the reflink-mask preamble per call (#4040)
• e250e31 fix: do not nest a link inside a link (#4051)
• See full diff in compare view

Updates sharp from 0.35.3 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

v0.35.4-rc.0

• Upgrade to libvips v8.18.6 for upstream bug fixes.

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

Commits

• 7f1a0a2 Release v0.35.4
• f927818 Upgrade to sharp-libvips v1.3.3
• e802092 Prerelease v0.35.4-rc.0
• e13eb2f CI: Fix wasm32 build (#4589)
• a82a0b3 Upgrade to libvips v8.18.6
• 8044fe4 Bound resize dimensions to coordinate limit
• 147f859 Docs: changelog entries for #4578 #4584
• ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
• 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
• ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude finished @dependabot[bot]'s task —— View job

---

Pull Request Review: Dependency Updates

I've completed a thorough review of these dependency updates. Here's my analysis:

---

🔒 Security Assessment

HIGHLY RECOMMENDED - All three updates include important security and stability fixes:

jose 6.2.9 → 6.2.10 (⚠️ Critical for this codebase)

Impact: HIGH - This library is used extensively for JWT authentication in your mobile app

Usage locations:

• web/src/lib/mobile-auth.ts - Mobile JWT signing and verification (HS256)
• web/src/app/api/auth/mobile/oauth/route.ts - Apple Sign In (remote JWKS verification)

Key security fixes (22 total):

• JWT validation hardening: Enforces explicit verification policies, prevents protected header replacement, validates builder claim values
• JWE encryption fixes: Conceals invalid CEK lengths (timing attack mitigation), enforces AES-GCM tag boundaries, validates encryption parameters
• JWK handling: Normalizes key resolution inputs, validates ext and key_ops parameters, accepts empty octet-sequence keys per spec
• JWKS remote loading: Orders overlapping reloads, rejects invalid duration values, enforces verification key metadata
• Serialization security: Consumes members once, rejects empty protected/AAD members, validates header values
• X.509 parsing: Rejects DER truncated past outer length

Recommendation: Merge immediately - These are defensive security improvements that harden JWT handling against edge cases and potential attacks. Your authentication system will be more robust.

---

marked 18.0.10 → 18.0.11

Impact: MEDIUM - Used for rendering markdown in admin announcements

Usage location:

• web/src/app/api/admin/announcements/route.ts:204 - Converts announcement body markdown to HTML for emails

Bug fixes:

• Prevents nested links (which violate HTML spec and can cause rendering issues)
• Fixes reference link masking preamble rebuild
• Preserves emphasis in rejected reference links

Security note: The markdown is rendered server-side and sent via email, not rendered in a browser context where XSS would be a concern. However, proper sanitization should still be considered if user-generated markdown is ever rendered in the web UI.

Recommendation: Safe to merge - Bug fixes improve correctness without breaking changes.

---

sharp 0.35.3 → 0.35.4

Impact: LOW - Used for profile photo processing

Usage location:

• web/src/lib/profile-photo-downloader.ts:59-65 - Resizes and compresses profile photos (400×400, JPEG quality 85)

Bug fixes:

• Bounds resize dimensions to coordinate limit (prevents potential DoS via extremely large dimensions)
• Bounds composite left/top to coordinate limit
• Rounds palette bit depth correctly for PNG/GIF
• Fixes tiff.subifd input option handling
• Fixes info.pages count when limiting input page range
• Improves Stream handling when finishing before output requested

Recommendation: Safe to merge - Bug fixes improve robustness and prevent edge-case failures.

---

🐛 Potential Issues

None identified. All updates are patch-level and backward compatible.

---

⚡ Performance Considerations

• jose: Refactorings include "compact" and "streamline" optimizations - should slightly improve JWT operations
• sharp: No performance regressions expected; Stream handling improvements may help in edge cases
• marked: No performance changes noted

---

🧪 Test Coverage Assessment

Existing coverage:

• jose: Unit tests exist at web/tests/mobile-auth.test.ts
• marked: Used in e2e tests indirectly (admin announcements flow)
• sharp: Image processing is tested functionally

Recommendations:

1. ✅ CI will validate: The existing test suite should catch any regressions
2. ✅ No new tests needed: These are patch updates fixing edge cases, not adding features
3. ⚠️ Manual verification suggested: After merge, test:
   • Mobile login flow (jose)
   • Admin announcement creation with markdown formatting (marked)
   • Profile photo upload/processing (sharp)

---

📋 Code Quality & Best Practices

Excellent - All three libraries:

• Follow semantic versioning correctly (patch releases)
• Provide detailed changelogs with commit references
• Include both fixes and refactorings (jose)
• Have active maintenance

Your codebase usage:

• ✅ Proper error handling around jose operations (try/catch in getMobileUser)
• ✅ Safe markdown rendering (server-side only, in email context)
• ✅ Sensible sharp configuration (bounded dimensions, quality settings)

---

✅ Final Recommendation

APPROVE AND MERGE

This is a high-value, low-risk update:

1. Security: The jose update includes 22 security hardening fixes directly relevant to your JWT-based mobile authentication
2. Stability: All three updates fix bugs that could cause issues in edge cases
3. Risk: Minimal - all are patch-level updates with no breaking changes
4. Testing: Your existing test suite provides adequate coverage

Action items:

• Wait for CI to pass (lint, typecheck, unit tests, e2e tests)
• Merge immediately once CI is green
• Optional: Manually test mobile login and admin announcements in staging

---