chore(deps): consolidate Dependabot PRs #82–#98 + security fixes

[pacphi]

Summary

Consolidates all 17 open Dependabot PRs into a single branch instead of merging
17 branches that each touch the same lockfile (guaranteed conflicts). Applies
every bump at latest-compatible-within-major, fixes the breakage two of the
bumps caused, and closes several security advisories the bumps alone didn't
fully address.

Superseded PRs

PR	Package	Bump	Area
#98	actions/setup-node	6 → 7	GitHub Actions
#97	serde_with	3.20.0 → 3.21.0	Rust (security fix, GHSA-7gcf-g7xr-8hxj)
#96	rust (Docker base image)	1.96-bookworm → 1.97-bookworm	Docker
#95	cmov	0.5.3 → 0.5.4	Rust (security fix, GHSA-3rjw-m598-pq24)
#94	DavidAnson/markdownlint-cli2-action	23 → 24	GitHub Actions
#93	actions/cache	4 → 6	GitHub Actions
#92	rust_decimal	1.42.0 → 1.42.1	Rust
#91	config	0.15.23 → 0.15.25 (latest patch, PR proposed .24)	Rust
#90	js-yaml (frontend)	4.2.0 → 5.2.2 (latest 5.x, PR proposed 5.0.0; security fix)	Frontend
#89	react-router-dom (frontend)	7.17.0 → 7.18.1 (latest 7.x, PR proposed 7.18.0)	Frontend — package since removed, see below
#88	prometheus-client	0.24.1 → 0.25.0	Rust
#87	react-router (frontend)	7.17.0 → 8.3.0 (latest 8.x, PR proposed 8.0.1; security fix)	Frontend
#86	chrono	0.4.44 → 0.4.45	Rust
#85	tailwindcss (frontend)	4.3.0 → 4.3.3 (latest, PR proposed 4.3.1)	Frontend
#84	tower-http	0.6.11 → 0.7.0	Rust
#83	@playwright/test (frontend)	1.59.1 → 1.62.0 (latest, PR proposed 1.61.0)	Frontend
#82	actions/checkout	6 → 7	GitHub Actions

Where a newer patch/minor existed than what Dependabot proposed (within the
same major it opened the PR for), the newer one was applied — same rule the
last two consolidation rounds (#51–#60, #61–#68, #70–#80) used.

Pre-existing / upgrade-caused fixes

These aren't in any of the 17 PRs' diffs — they're fallout from applying the
bumps, or drift that accumulated since the branch was last green (2026-06-15):

• react-router-dom still pulled a vulnerable react-router@7.18.1
  internally (GHSA-qwww-vcr4-c8h2, high, RSC Mode CSRF bypass, fixed at
  >=8.3.0) even after bumping the top-level react-router dependency to
  8.3.0 — nothing in src/ imported from it, so the vulnerable nested copy
  from react-router-dom was the one actually in use. react-router v8
  folds DOM bindings (BrowserRouter, NavLink, useNavigate, Outlet,
  Routes, Route, Navigate, useParams, useSearchParams,
  useLocation, …) into the main package, and react-router-dom has no v8
  release. Migrated all 14 import sites from react-router-dom to
  react-router and dropped react-router-dom from package.json — it's
  now fully unused. pnpm why react-router confirms a single resolved copy
  at 8.3.0 post-fix.
• js-yaml 5.x dropped its CJS default export (ESM-only build, named
  exports only). The one call site (frontend/src/stores/configStore.ts)
  used import yaml from 'js-yaml'; yaml.load(...), which silently resolved
  to undefined under Vite/Vitest's real ESM resolution — the two YAML
  config tests failed with TypeError: Cannot read properties of undefined (reading 'load'). Fixed to import { load } from 'js-yaml'.
• Removed @types/js-yaml — js-yaml 5.x ships its own bundled types
  (dist/js-yaml.d.ts), and no v5-compatible @types/js-yaml release
  exists (still pinned at 4.0.9).
• Rust RUSTSEC advisories disclosed 2026-06-20 → 2026-07-06 (after
  main's last green CI run on 2026-06-15), caught by
  .github/scripts/cargo-audit.sh:
  • RUSTSEC-2026-0195 / RUSTSEC-2026-0194 (quick-xml, high, DoS via
    unbounded namespace allocation / quadratic attribute checking) — fixed
    at >=0.41.0. Our own quick-xml = "0.40" constraint bumped to
    "0.41"; the two remaining vulnerable copies were transitive
    (feed-rs → quick-xml 0.37.5, calamine → quick-xml 0.39.4).
    Bumped feed-rs 2.3.1 → 2.4.0 and calamine 0.35 → 0.36 (both require
    quick-xml ^0.41), which collapsed all three resolutions into one
    quick-xml 0.41.0.
  • RUSTSEC-2026-0185 (quinn-proto, high, remote memory exhaustion) →
    0.11.14 → 0.11.16.
  • RUSTSEC-2026-0190 (anyhow, unsound downcast_mut) → 1.0.102 →
    1.0.104.
  • RUSTSEC-2026-0186 (memmap2, unsound pointer offset) → 0.9.10 →
    0.9.11.
  • RUSTSEC-2026-0204 (crossbeam-epoch, invalid pointer deref in Debug
    impl) → 0.9.18 → 0.9.20.
  • All four are transitive; fixed via cargo update -p <crate> --precise <version> within the ranges the workspace's direct dependencies
    already allow.
• pnpm audit findings not covered by any of the 17 PRs (transitive
  dev dependencies, resolved via pnpm update within existing semver
  ranges — no manifest changes needed):
  • postcss 8.5.15 → 8.5.23 (path traversal via sourceMappingURL
    auto-loading, high, fixed >=8.5.18) — pulled in by vite.
  • undici 7.25.0 → 7.29.0 (TLS cert bypass + others, high, fixed
    >=7.28.0) — pulled in by jsdom/vitest.
  • brace-expansion 5.0.6 → 5.0.8 (two DoS advisories, high, fixed
    >=5.0.8) — pulled in by eslint → minimatch.
• cargo clippy --workspace --all-targets -- -D warnings failed on GitHub's
  runner despite passing locally, first time this PR's CI ran. Root cause:
  dtolnay/rust-toolchain@stable resolved to rustc 1.97.1 (current "stable"
  as of today), newer than the local toolchain used for the first round of
  verification (1.96.0). crates/finima-api/src/handlers/uploads.rs:51,
  fn default_true() — used via #[serde(default = "default_true")] on
  ConfirmRequest.skip_duplicates, and genuinely called at runtime — got
  flagged dead_code because --all-targets also builds a test variant
  of the finima-api bin crate, where dead-code reachability roots at the
  test harness rather than the real main, so the route path that reaches
  default_true isn't visible to that pass. Fixed with #[allow(dead_code)]
  on the function, matching the identical annotation already on
  ConfirmRequest one line above it (same false positive, same existing
  fix pattern). Confirmed this reproduces on unmodified main too under
  1.97.1 — pre-existing toolchain drift, unrelated to any bump in this PR;
  main's last green CI run (2026-06-15) predates that rustc release.

Not touched: docs/guides/maintainer-guide.md says "Rust stable (1.96+)" —
still accurate after the Docker base image bump to 1.97. The Rust version in
docs/plan/origin/07-DEPLOYMENT.md is a dated (2026-04-10) historical
planning snapshot, not living documentation, so it was left as-is.

Security audit

cargo audit (.github/scripts/cargo-audit.sh, --deny warnings +
audit-ignore exceptions): clean. 7 pre-existing documented exceptions in
audit-ignore (RUSTSEC-2023-0071, -2026-0097, -2025-0141, -2026-0105,
-2025-0057, -2025-0119, -2024-0436) untouched — none of them relate to any
dependency this PR bumps. All 6 newly-disclosed advisories found this run
are fixed (see above); none deferred.

pnpm audit: clean (was 9 findings across react-router, postcss,
undici, brace-expansion — 3 high, 4 moderate/low — before this PR; all
fixed, see above).

GitHub Dependabot alerts (gh api repos/pacphi/finima/dependabot/alerts,
open, pre-PR): serde_with (#24, medium, GHSA-7gcf-g7xr-8hxj) and cmov
(#23, medium, GHSA-3rjw-m598-pq24) are closed by this PR's serde_with/cmov
bumps (superseding #97/#95). The remaining open alerts (brace-expansion #25,
undici #16–22) are the same findings pnpm audit surfaced above and are
fixed by this PR; they should auto-close once merged.

Verification

All commands run locally against this branch's HEAD, mirroring
.github/workflows/ci.yml and Makefile exactly. Rerun under rustc 1.97.1
(matching CI's dtolnay/rust-toolchain@stable) after the default_true fix:

• cargo fmt --all -- --check — pass
• cargo clippy --workspace --all-targets -- -D warnings — pass, 0 warnings
• TEST_DATABASE_URL=postgres://finima:test@localhost:5433/finima_test APP_ENV=test cargo test --workspace (Postgres 16 via docker-compose.test.yml) — 28/28 test binaries pass, 0 failures
• GitHub Actions run on this PR's HEAD: Validate Markdown, Validate YAML,
  Backend Lint, Backend Security Audit, Frontend Lint, Frontend Tests,
  Backend Tests all green (LLM Integration Tests / E2E Tests skipped —
  same as on main, gated behind repo vars)
• bash .github/scripts/cargo-audit.sh — pass, 0 vulnerabilities
• pnpm install --frozen-lockfile (frontend) — pass, lockfile reproducible
• pnpm exec tsc --noEmit — pass
• pnpm run lint (eslint) — pass
• pnpm exec prettier --check 'src/**/*.{ts,tsx,css}' — pass
• pnpm run test -- --run (vitest) — 9/9 tests pass
• pnpm run build (tsc -b && vite build) — pass
• pnpm audit — 0 vulnerabilities
• pnpm exec playwright test --list — config loads under 1.62.0, 72 tests enumerated across 5 spec files (full E2E run needs a live backend/Postgres/MinIO stack and is gated behind E2E_ENABLED in CI same as on main; not run here)

🤖 Generated with Claude Code

[pacphi]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.