Patch vue, source-map-js, and fsspec security alerts

[wasimxyz]

Summary

Closes three high-severity Dependabot alerts and refreshes the web app's lockfile. Only lockfiles change. No version ranges in package.json or pyproject.toml move.

 docs/site/package-lock.json
-  @vue/server-renderer 3.5.39
+  @vue/server-renderer 3.5.43
-  source-map-js 1.2.1
+  source-map-js 1.2.2
 uv.lock
-  fsspec 2026.3.0
+  fsspec 2026.9.0
 web/package-lock.json
-  shadcn 4.21.3
+  shadcn 4.21.4

Docs site (docs/site/package-lock.json)

Ran npm audit fix in docs/site/.

• @vue/server-renderer and the other @vue/* packages 3.5.39 → 3.5.43 (high): cross-site scripting through attribute names. GHSA-g2v6-rqmx-r4w6. vue is pulled in by @vercel/analytics.
• source-map-js 1.2.1 → 1.2.2 (high): denial of service through crafted source-map offsets. GHSA-68fv-2mgg-jv7q
• npm also moved mermaid from 11.16.1 to 11.17.2, inside the existing ^11.16.0 range.

Python (uv.lock)

Ran uv lock --upgrade-package fsspec.

• fsspec 2026.3.0 → 2026.9.0 (high): template injection in ReferenceFileSystem that can run arbitrary code. GHSA-27vj-qcqg-25rc

fsspec reaches the lambda package through arcadia-microscopy-tools, nd2, and dask. Nothing in watcher/src/ changes, so the watcher version stays the same.

Web app (web/package-lock.json)

Ran npm audit fix in web/. This closes no advisories: the web app has the same 10 findings (9 high, 1 moderate) before and after. npm tried to fix braces by updating the packages that depend on it, and left these changes:

• shadcn 4.21.3 → 4.21.4 and @shadcn/registry 0.1.2 → 0.1.3.
• @dotenvx/dotenvx 1.59.1 → 1.75.1, a dependency of shadcn. It adds systeminformation, conf, and enquirer, and drops eciesjs and the @noble/* packages.

shadcn is a dev dependency, but app/globals.css imports shadcn/tailwind.css. That file is identical in 4.21.3 and 4.21.4.

Still open

• braces (high), in both web/ and docs/site/: no patched release exists. The latest version, 3.0.3, is still affected. GHSA-vfj7-8cjw-p6xm
• @better-auth/oauth-provider (moderate), in web/: pinned to exactly 1.6.27, and the fix is in 1.7.7. That upgrade touches MCP sign-in, so it belongs in its own PR. GHSA-p2fr-6hmx-4528
• katex (low), in docs/site/: npm's only fix is downgrading mermaid to 10.8.0, so this PR does not do that. GHSA-238p-pmpm-9mq7

Evidence

• Before: npm audit in docs/site/ reports 9 findings (7 high, 2 low). uv.lock has fsspec 2026.3.0, inside the affected range (below 2026.6.0). npm audit in web/ reports 10 findings (9 high, 1 moderate).
  After: npm audit in docs/site/ reports 6 findings (4 high, 2 low), all from braces and katex. uv.lock has fsspec 2026.9.0. npm audit in web/ still reports 10 findings.

Testing:

• make check
• make fe-test-unit: 562 passing
• make py-test-unit: 1073 passing
• make docs-build

Merge Danger

Door: Two-way. The change is lockfile-only, so reverting the commit restores the previous versions.

Blast Radius: Small. fsspec runs inside file processing in lambda. The docs-site changes affect how the published docs site is built, including mermaid diagrams. The web app change only affects the shadcn CLI, and the CSS the app imports from it is unchanged.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
data-hub	Ready	Preview	Oct 11, 2026 12:30am UTC
data-hub-docs	Ready	Preview	Oct 11, 2026 12:30am UTC