fix: upgrade vulnerable dependencies with override enforcement

[Jkavia]

PR Description

• Add security overrides for orjson, gunicorn, pypdf, nltk, markdown, dynaconf, pillow
• Update base pyproject.toml: pillow>=12.0.0, pypdf>=6.9.0
• Selective upgrade: only orjson (3.11.7->3.11.8) and pillow (11.3.0->12.2.0)
• Resolves 7/8 flagged CVEs (diskcache awaiting upstream fix)
• Defense-in-depth: TOML minimums + override enforcement

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2dc5db13-b661-4313-87e0-8157aad64454

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/fixes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.13%. Comparing base (d4de34d) to head (3868940).
⚠️ Report is 2 commits behind head on release-1.9.0.

❌ Your project status has failed because the head coverage (49.07%) is below the target coverage (60.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@                Coverage Diff                @@
##           release-1.9.0   #12526      +/-   ##
=================================================
+ Coverage          49.84%   50.13%   +0.28%     
=================================================
  Files               1930     1932       +2     
  Lines             171909   172044     +135     
  Branches           25324    24162    -1162     
=================================================
+ Hits               85695    86253     +558     
+ Misses             85170    84746     -424     
- Partials            1044     1045       +1     

Flag	Coverage Δ
backend	55.94% <ø> (-0.01%)	⬇️
frontend	49.03% <ø> (+0.42%)	⬆️
lfx	49.07% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 185 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Frontend Unit Test Coverage Report

Coverage Summary

Lines	Statements	Branches	Functions
	29.72% (31355/105494)	63.74% (3985/6251)	31.06% (732/2356)

Unit Test Results

Tests	Skipped	Failures	Errors	Time
3112	0 💤	0 ❌	0 🔥	4m 30s ⏱️