chore: harden dependency advisory follow-through

[myth05]

Summary

• pin npm dependency ranges across JS package roots
• bump Hermes lockfile remediation for urllib3/litellm
• reconcile website Mermaid advisory
• reconcile WhatsApp bridge protobufjs advisory and Express audit findings

Verification

• uv lock --check
• active .venv core import smoke + urllib3 2.7.0 import
• website npm audit --omit=dev clean
• website build succeeds with pre-existing broken-link/anchor warnings
• WhatsApp bridge npm audit --omit=dev clean
• WhatsApp bridge node --check bridge.js

[austinpickett]

Review notes

The security intent is right, but this PR is significantly stale and several changes conflict with or regress main:

Already on main — no-op or regression:

• urllib3 is already at 2.7.0 on main's uv.lock (PR bumps to same or older)
• litellm bump in uv.lock: please verify main's current version — if main is already at ≥1.83.0 this is stale
• All ui-tui/package.json ^→exact-pin changes: converting every dep to exact (no ^) is a significant scope change beyond security patching — this breaks the maintainers' policy of letting minor/patch ranges slide naturally. Please revert the dep-range pinning and only bump packages with CVEs.

Conflict with main's existing overrides:

• website/package.json: main has {"serialize-javascript": "^7.0.5", "uuid": "^14.0.0"}. Your diff adds a mermaid override and bumps Docusaurus from 3.9.2→3.10.1 — that's a minor version bump beyond security scope. If the Mermaid advisory is the real fix, please extract just the mermaid override into a focused PR.

No CI run — no checks reported on this branch.

Recommended path: This PR has grown too broad to merge cleanly. Please consider opening 2–3 focused PRs from main:

1. Python lockfile (uv.lock): if urllib3/litellm are already on main, this may be a no-op
2. Website Mermaid advisory (website/package.json + website/package-lock.json only)
3. WhatsApp bridge audit fixes (scripts/whatsapp-bridge/ only) — note fix(whatsapp): bump Baileys pin to v7.0.0-rc13 to fix LID-addressed group sends #43840 may have handled the Baileys pin

Happy to re-review targeted PRs from current main.

[myth05]

Thanks, Austin. Agreed — this PR is stale/broad. I checked current main and split out the one clean scripts-only remediation:

• fix(whatsapp-bridge): refresh audit lockfile #44358 — fix(whatsapp-bridge): refresh audit lockfile

That PR is only scripts/whatsapp-bridge/package-lock.json, generated with npm audit fix --package-lock-only --omit=dev; it avoids exact-pinning direct dependency ranges. Verification:

npm --prefix scripts/whatsapp-bridge audit --omit=dev --audit-level=moderate --json
# moderate/high: 0; critical: 1 Baileys advisory remains, npm reports fixAvailable=false
node --check scripts/whatsapp-bridge/bridge.js

Current main already has urllib3 at 2.7.0; litellm is no longer present in uv.lock, so I am not opening a Python-lock PR. I also tested the website Mermaid-only override from current main, but it changed only website/package.json and did not change the lockfile/audit result; current website audit is now the Docusaurus/Joi chain, so I am not opening that as a fake remediation.

[austinpickett]

Closing this one as agreed — the clean scripts-only remediation is now #44358 (approved). As you confirmed, urllib3 is already 2.7.0 on main, litellm is no longer in uv.lock, and the website override was a no-op against current main, so there's nothing left here worth carrying that isn't covered by #44358. Thanks for the quick, focused split, @myth05.