Bump deps to clear Dependabot security alerts

[skearnes]

What

Clears all 16 open Dependabot security alerts by upgrading to patched versions. No application code changes — only uv.lock, app/package.json, and app/package-lock.json.

Python (transitive, via uv.lock)

Package	From	To	Alerts
starlette	1.0.0	1.3.1	#80–#83, #66
cryptography	48.0.0	49.0.0	#79
pyjwt	2.12.1	2.13.0	#69–#73

JavaScript (app/)

Package	From	To	Alerts	How
vite	7.3.3	7.3.5	#76, #77	^7.3.5 floor in package.json
@babel/core	7.29.0	7.29.7	#74	npm update (transitive)
js-yaml	4.1.1	4.2.0	#75	npm update (transitive)
esbuild	0.27.7	0.28.1	#67	overrides pin (see below)

esbuild override: vite 7.3.5 still constrains esbuild to ^0.27.0, so the patched 0.28.1 can't be reached by a normal update. The alert (GHSA dev-server CORS issue) is dev-server-only, low severity, and first patched in 0.28.1, so I pinned it via an overrides entry rather than forcing a vite 8.x major upgrade (out of scope for a security patch). The build runs fine on esbuild 0.28.1.

Verification

• npm install → 0 vulnerabilities; npm run build + npm run lint clean.
• uv sync + pytest ord_interface/api ord_interface/visualization → 59 passed on the upgraded Python deps.

🤖 Generated with Claude Code

Greptile Summary

Upgrades transitive Python dependencies (starlette, cryptography, pyjwt) and JavaScript dependencies (vite, @babel/core, js-yaml, esbuild) to versions that clear all 16 open Dependabot security alerts. No application code is modified.

• Python deps are bumped only in uv.lock; starlette goes from 1.0.0 → 1.3.1 (the largest jump), cryptography to 49.0.0, and pyjwt to 2.13.0.
• JavaScript bumps are in package.json and package-lock.json; because vite 7.x still constrains esbuild to ^0.27.x, the patched esbuild 0.28.1 is pinned via an npm overrides entry — a correct and idiomatic approach for npm workspaces when the transitive range cannot be satisfied normally.

Confidence Score: 5/5

Pure dependency version bump with no application logic changes; all three patched Python packages and all four patched JS packages land on well-tested, widely-adopted versions.

Every change is a version number or a lock-file hash. The esbuild override via npm overrides is the correct idiom and is already reflected in the committed package-lock.json, so there is no risk of the wrong version being installed. The starlette jump (1.0.0 → 1.3.1) is the most significant Python version leap, but the project's own test suite was run against it per the PR description. No code paths changed.

No files require special attention — all three files are lock files or the manifest that drives them.

Important Files Changed

Filename	Overview
app/package.json	Bumps vite floor from ^7.1.7 to ^7.3.5 and adds an npm overrides entry to pin esbuild to ^0.28.1, addressing the patched dev-server CORS advisory
app/package-lock.json	Lock file regenerated to reflect updated versions: vite 7.3.5, @babel/* 7.29.7, js-yaml 4.2.0, esbuild 0.28.1 (via override)
uv.lock	Python lock file updated for cryptography (48→49), pyjwt (2.12.1→2.13.0), and starlette (1.0.0→1.3.1); all hashes refreshed

_{Reviews (1): Last reviewed commit: "Bump dependencies to clear Dependabot se..." | Re-trigger Greptile}