chore: resolve dependabot security alerts (pnpm + pip)

[sriramveeraghanta]

Summary

Resolves the open Dependabot security alerts across both ecosystems in one PR.

Python — apps/api/requirements/base.txt

Package	From	To	Alerts
cryptography	48.0.1	50.0.0	#302, #303, #304, #305, #306 (high, PKCS#7 Bleichenbacher oracle)

All requirements files (requirements.txt, local.txt, production.txt, test.txt) chain to base.txt, so the single pin bump covers all five alerts. The only direct usage is cryptography.fernet.Fernet (apps/api/plane/license/utils/encryption.py), which is unaffected by the 50.x breaking changes — verified with a local install + encrypt/decrypt roundtrip.

npm — pnpm-workspace.yaml (catalog + overrides) and pnpm-lock.yaml

Package	From	To	Alerts
react-router	7.15.1	7.18.1	#287, #290, #291, #292 (open redirect, DoS, XSS, constructor injection)
@react-router/dev	7.15.0	7.17.0	companion bump (latest 7.x)
@react-router/node, @react-router/serve	7.15.0	7.18.1	companion bumps to match react-router
sharp	^0.34.3	^0.35.3	#285 (high, libvips CVEs)
fast-uri	3.1.2	3.1.5 (override)	#284, #286, #309 (high, host confusion)
js-yaml	4.2.0	4.3.0 (override)	#281 (high, quadratic CPU DoS)
linkify-it	5.0.1	5.0.2 (override)	#283 (high, mailto validator DoS)
postcss	8.5.15	8.5.25	#293, #308 (source map path traversal / arbitrary file read)
undici	7.28.0	7.29.0 (override)	#297, #298, #299, #300, #301 (info disclosure, CRLF/cookie injection)
sanitize-html	2.17.0	2.17.5	#295 (medium, URI scheme validation bypass)
valibot	1.2.0	1.4.2 (override)	#288 (medium)
body-parser	1.20.3	1.20.6 (override)	#282 (low, size-limit bypass)

Notes:

• fast-uri is pinned to 3.1.5 (not 4.x) because its only consumer is ajv@8, which declares fast-uri@^3 — 3.1.5 patches all three fast-uri advisories on the 3.x line.
• @react-router/node override (7.18.1) dedupes the copy pinned by @react-router/dev@7.17.0 so a single, patched react-router tree is used.

Remaining alert (not fixable yet)

• build(deps): bump django from 3.2.17 to 3.2.18 in /apiserver/requirements #289 — react-router RSC Mode CSRF Bypass (high): patched only in react-router 8.3.0, but @react-router/dev/serve/node have no stable 8.x release yet (only 8.0.0-pre.x). This needs to wait for the stable v8 toolchain; it also only affects RSC mode, which these apps do not use.

Verification

• pnpm install — clean, no new peer warnings
• pnpm check:types — 28/28 tasks pass
• pnpm check:lint — 16/16 tasks pass, 0 errors
• pnpm build — 16/16 tasks pass (web, admin, space, live all build)
• cryptography==50.0.0 pip install + Fernet roundtrip — pass

Summary by CodeRabbit

• Chores
  • Updated the cryptography package to a newer version.
  • Refreshed workspace dependency versions and security-related overrides.
  • Updated compatibility rules for several supporting packages.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e1f880b1-eb51-4905-8a8c-ed9f94d74615

📥 Commits

Reviewing files that changed from the base of the PR and between fa02716 and d2eb7d2.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• apps/api/requirements/base.txt
• pnpm-workspace.yaml

---

📝 Walkthrough

Walkthrough

The pull request updates the pinned cryptography version and refreshes JavaScript workspace catalog versions and dependency overrides.

Changes

Dependency updates

Layer / File(s)	Summary
Python dependency pin apps/api/requirements/base.txt	Updates cryptography from 48.0.1 to 50.0.0.
Workspace catalogs and overrides pnpm-workspace.yaml	Updates catalog versions and override ranges for React Router, PostCSS, sanitize-html, sharp, Valibot, undici, fast-uri, js-yaml, linkify-it, body-parser, and @react-router/node.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• makeplane/plane#9153: Both pull requests modify dependency catalog entries in pnpm-workspace.yaml.
• makeplane/plane#9456: Both pull requests update dependency versions and overrides in pnpm-workspace.yaml.

Suggested reviewers: codingwolf-at, prateekshourya29

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies dependency security alert fixes across the pnpm and pip ecosystems.
Description check	✅ Passed	The description gives a detailed change summary, affected alerts, remaining risk, and verification results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-security-fixes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR resolves open Dependabot security alerts by updating pinned dependencies across the JS (pnpm catalog/overrides + lockfile) and Python (pip requirements) ecosystems.

Changes:

• Bumped react-router and related @react-router/* packages to patched 7.x releases via pnpm catalog/overrides.
• Updated several vulnerable transitive dependencies (e.g., undici, fast-uri, js-yaml, linkify-it, body-parser, postcss, sanitize-html, sharp, valibot) via catalog bumps and overrides, with corresponding lockfile updates.
• Upgraded Python cryptography in apps/api/requirements/base.txt to address high-severity advisories.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
pnpm-workspace.yaml	Updates pnpm catalog pins and adds/adjusts overrides to force patched versions across the monorepo.
pnpm-lock.yaml	Regenerates lockfile to reflect the updated catalog/override resolutions and patched transitive graph.
apps/api/requirements/base.txt	Bumps cryptography to a patched version for API Python dependencies.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file