ChiefStief · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026
diff --git a/backend/compact-connect-ui-app/requirements-dev.txt b/backend/compact-connect-ui-app/requirements-dev.txt
@@ -38,7 +38,7 @@ markdown-it-py==4.2.0
     # via rich
 mdurl==0.1.2
     # via markdown-it-py
-msgpack==1.2.1
+msgpack==1.2.3
     # via cachecontrol
 packageurl-python==0.17.6
     # via cyclonedx-python-lib

diff --git a/backend/compact-connect/compact-config/attestations.yml b/backend/compact-connect/compact-config/attestations.yml
@@ -3,7 +3,9 @@ attestations:
     displayName: "Jurisprudence Confirmation."
     description: "For displaying the jurisprudence confirmation."
     text: |-
-      I understand that my attestation is a legally binding statement. I understand that providing false information on this application could result in a loss of my licenses and/or privileges. I acknowledge that the Commission may audit jurisprudence attestations at their discretion.
+      If a jurisprudence requirement exists for the state(s) from which I have chosen to receive a privilege to practice, I attest that I have reviewed the jurisprudence requirements for that state, have successfully completed or will successfully complete the jurisprudence requirement for that state within the time frame required by that state, and understand that failure to successfully and timely complete any jurisprudence requirement may lead to revocation of my privilege to practice and disciplinary action from that state which could jeopardize my participation in the compact.
+
+      I understand that my attestation is a legally binding statement. I understand that providing false information on this application could result in a loss of my licenses and/or privileges. I acknowledge that the Commission and states may audit jurisprudence attestations at their discretion.
     required: true
     locale: "en"
   - attestationId: "scope-of-practice-attestation"

diff --git a/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt b/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
@@ -76,7 +76,7 @@ mdurl==0.1.2
     # via markdown-it-py
 moto[dynamodb,s3]==5.2.2
     # via -r requirements-dev.in
-msgpack==1.2.1
+msgpack==1.2.3
     # via cachecontrol
 packageurl-python==0.17.6
     # via cyclonedx-python-lib

diff --git a/backend/compact-connect/requirements-dev.txt b/backend/compact-connect/requirements-dev.txt
@@ -40,7 +40,7 @@ markdown-it-py==4.2.0
     # via rich
 mdurl==0.1.2
     # via markdown-it-py
-msgpack==1.2.1
+msgpack==1.2.3
     # via cachecontrol
 packageurl-python==0.17.6
     # via cyclonedx-python-lib

diff --git a/backend/cosmetology-app/requirements-dev.txt b/backend/cosmetology-app/requirements-dev.txt
@@ -40,7 +40,7 @@ markdown-it-py==4.2.0
     # via rich
 mdurl==0.1.2
     # via markdown-it-py
-msgpack==1.2.1
+msgpack==1.2.3
     # via cachecontrol
 packageurl-python==0.17.6
     # via cyclonedx-python-lib

diff --git a/backend/dietitian-app/lambdas/nodejs/package.json b/backend/dietitian-app/lambdas/nodejs/package.json
@@ -6,7 +6,7 @@
   "resolutions": {
     "fast-xml-parser": "5.7.3",
     "postcss": "8.5.24",
-    "sanitize-html": "2.17.7",
+    "sanitize-html": "2.18.1",
     "source-map-js": "1.2.2"
   },
   "scripts": {
@@ -52,7 +52,7 @@
     "@aws-sdk/client-sesv2": "^3.1045.0",
     "@aws-sdk/util-dynamodb": "^3.996.2",
     "@csg-org/email-builder": "^0.0.15",
-    "nodemailer": "^10.1.1",
-    "zod": "^3.23.8"
+    "nodemailer": "^10.1.4",
+    "zod": "^4.6.6"
   }
 }
diff --git a/backend/dietitian-app/lambdas/nodejs/yarn.lock b/backend/dietitian-app/lambdas/nodejs/yarn.lock
@@ -3311,10 +3311,10 @@ csstype@^3.2.2:
   resolved "https://registry.yarnpkg.com/csstype/-/csstype-3.2.3.tgz#ec48c0f3e993e50648c86da559e2610995cf989a"
   integrity sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==
 
-dayjs@^1.11.7:
-  version "1.11.21"
-  resolved "https://registry.yarnpkg.com/dayjs/-/dayjs-1.11.21.tgz#57f87562e62de76f3c704bd2b8d522fc33068eb2"
-  integrity sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA==
+dayjs@^1.11.23:
+  version "1.11.23"
+  resolved "https://registry.yarnpkg.com/dayjs/-/dayjs-1.11.23.tgz#b0a363506dde5f36cf5075e42ebe8115165a8c79"
+  integrity sha512-QDTCU0M0MxR3hQfnlDJfwekQiaanm1ubOD231u73WBckQ/fsamwRLiE2GBz6D3a/xF1NgfiDLJjXBa1hYOYTtQ==
 
 debug@^4.1.0, debug@^4.1.1, debug@^4.3.1, debug@^4.3.2, debug@^4.3.5, debug@^4.4.3:
   version "4.4.3"
@@ -3345,7 +3345,7 @@ deep-is@^0.1.3:
   resolved "https://registry.yarnpkg.com/deep-is/-/deep-is-0.1.4.tgz#a6f2dce612fadd2ef1f519b73551f17e85199831"
   integrity sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==
 
-deepmerge@^4.2.2, deepmerge@^4.3.1:
+deepmerge@^4.3.1:
   version "4.3.1"
   resolved "https://registry.yarnpkg.com/deepmerge/-/deepmerge-4.3.1.tgz#44b5f2147cd3b00d4b56137685966f26fd25dd4a"
   integrity sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==
@@ -3949,10 +3949,10 @@ is-plain-obj@^2.1.0:
   resolved "https://registry.yarnpkg.com/is-plain-obj/-/is-plain-obj-2.1.0.tgz#45e42e37fccf1f40da8e5f76ee21515840c09287"
   integrity sha512-YWnfyRwxL/+SsrWYfOpUtz5b3YD+nyfkHvjbcanzk8zgyO4ASD67uVMRt8k5bM4lLMDnXfriRhOpemw+NfT1eA==
 
-is-plain-object@^5.0.0:
-  version "5.0.0"
-  resolved "https://registry.yarnpkg.com/is-plain-object/-/is-plain-object-5.0.0.tgz#4427f50ab3429e9025ea7d52e9043a9ef4159344"
-  integrity sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==
+is-plain-object@^5.1.0:
+  version "5.1.0"
+  resolved "https://registry.yarnpkg.com/is-plain-object/-/is-plain-object-5.1.0.tgz#22ed7b5e856bb57966348e5b9468dada42be87f4"
+  integrity sha512-bUi/yjmtKYcRVUtWRGr0UA6xEFh2I6zWUwMrUXB3s7bmYCaZ8a+0ZsTRkrawh/mzlSD1Y0Ph8bp/U+TvBpWDNw==
 
 is-stream@^2.0.0:
   version "2.0.1"
@@ -4452,12 +4452,12 @@ lambda-local@^2.2.0:
     dotenv "^16.3.1"
     winston "^3.10.0"
 
-launder@^1.7.1:
-  version "1.7.1"
-  resolved "https://registry.yarnpkg.com/launder/-/launder-1.7.1.tgz#ef7155ab0c3ddec2323089c961d2e9a249aa5b0d"
-  integrity sha512-mU6WRz5EusL9ZZuiZ5SO4Y6C0P9PAUR9iwdb6bzj4KDihm28DiHFw+/yk9DBH4f+Pv1wuzQ4e2jV3oQ7mkIqvw==
+launder@^1.7.2:
+  version "1.7.2"
+  resolved "https://registry.yarnpkg.com/launder/-/launder-1.7.2.tgz#5ddfddbcb565d208e4c702e94b043a11bfb32653"
+  integrity sha512-DLg3HPnHUfBi5/MxMLmJD12dmlMpFEC2HgMW6vkZ/9JR0RU00kXoRGvDxAvFmdO0o610OA77i4FgNTLucmhDVg==
   dependencies:
-    dayjs "^1.11.7"
+    dayjs "^1.11.23"
 
 leven@^3.1.0:
   version "3.1.0"
@@ -4709,10 +4709,10 @@ node-releases@^2.0.27:
   resolved "https://registry.yarnpkg.com/node-releases/-/node-releases-2.0.27.tgz#eedca519205cf20f650f61d56b070db111231e4e"
   integrity sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==
 
-nodemailer@^10.1.1:
-  version "10.1.1"
-  resolved "https://registry.yarnpkg.com/nodemailer/-/nodemailer-10.1.1.tgz#c2cc02c3aef8a1697bae6501d362a594551fdd6b"
-  integrity sha512-pbqZRoeYUO+1E8TJ/11WeY4D2EVujj1hsYjz3qff/vUFDtGnmi7p3iqzTFslYOfQ6PnjVcWxx/CIUSHCSrO/QA==
+nodemailer@^10.1.4:
+  version "10.3.1"
+  resolved "https://registry.yarnpkg.com/nodemailer/-/nodemailer-10.3.1.tgz#77295b3b5dd00b93e96962a55255a21321ce8f32"
+  integrity sha512-uF0AFsJC07Y1vdW7p580DKAnh7rAO+4UPSSB3mDCPNDufoiaOebV6JmrzpxB14OjEEEiBsNdYoM2Y+fN8M7BBA==
 
 normalize-path@^3.0.0:
   version "3.0.0"
@@ -4882,7 +4882,7 @@ pkg-dir@^4.2.0:
   dependencies:
     find-up "^4.0.0"
 
-postcss@8.5.24, postcss@^8.3.11:
+postcss@8.5.24, postcss@^8.5.27:
   version "8.5.24"
   resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.24.tgz#01d8b032451e1b9ec41ae66eaf02843f42a720d2"
   integrity sha512-8RyVklq0owXUTa4xlpzu4l9AaVKIdQvAcOHZWaMh98HgySsUtxRVf/chRe3dsSLqb6i40BzGRzEUddRaI+9TSw==
@@ -4994,18 +4994,17 @@ safe-stable-stringify@^2.3.1:
   resolved "https://registry.yarnpkg.com/safe-stable-stringify/-/safe-stable-stringify-2.5.0.tgz#4ca2f8e385f2831c432a719b108a3bf7af42a1dd"
   integrity sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==
 
-sanitize-html@2.17.7, sanitize-html@^2.17.0:
-  version "2.17.7"
-  resolved "https://registry.yarnpkg.com/sanitize-html/-/sanitize-html-2.17.7.tgz#b16417c348ea5f99c2451964b6e6621ca6b1da94"
-  integrity sha512-PGtEkc9cbnedU3s9TmzDbpsZ8w086g/0Q8k8/oIO1NLNU3i5k9yn835CrjJSajp1KMmkisbO1qPXxNKO3welAg==
+sanitize-html@2.18.1, sanitize-html@^2.17.0:
+  version "2.18.1"
+  resolved "https://registry.yarnpkg.com/sanitize-html/-/sanitize-html-2.18.1.tgz#a2b5447020db598fb65f6865bdf37e25e8cff09d"
+  integrity sha512-2X5lC8fYla8YaT8g73Nj+HcLWXan5dLyCWLgVvaOmfw7JI78IRsyNtIDytTHdn7hBQbIkCah7Zbmd5jabzeDig==
   dependencies:
-    deepmerge "^4.2.2"
     escape-string-regexp "^4.0.0"
     htmlparser2 "^12.0.0"
-    is-plain-object "^5.0.0"
-    launder "^1.7.1"
+    is-plain-object "^5.1.0"
+    launder "^1.7.2"
     parse-srcset "^1.0.2"
-    postcss "^8.3.11"
+    postcss "^8.5.27"
 
 scheduler@^0.23.2:
   version "0.23.2"
@@ -5564,7 +5563,7 @@ yocto-queue@^0.1.0:
   resolved "https://registry.yarnpkg.com/yocto-queue/-/yocto-queue-0.1.0.tgz#0294eb3dee05028d31ee1a5fa2c556a6aaf10a1b"
   integrity sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==
 
-zod@^3.23.8:
-  version "3.25.76"
-  resolved "https://registry.yarnpkg.com/zod/-/zod-3.25.76.tgz#26841c3f6fd22a6a2760e7ccb719179768471e34"
-  integrity sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==
+zod@^4.6.6:
+  version "4.6.7"
+  resolved "https://registry.yarnpkg.com/zod/-/zod-4.6.7.tgz#e806cf64a7f4e37635ce9f2f52c04c3766f75e5b"
+  integrity sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==
diff --git a/backend/dietitian-app/lambdas/python/cognito-backup/requirements-dev.txt b/backend/dietitian-app/lambdas/python/cognito-backup/requirements-dev.txt
@@ -16,7 +16,7 @@ botocore==1.43.78
     #   boto3
     #   moto
     #   s3transfer
-certifi==2026.6.17
+certifi==2026.10.19
     # via requests
 cffi==2.0.0
     # via cryptography

diff --git a/backend/dietitian-app/lambdas/python/common/requirements-dev.txt b/backend/dietitian-app/lambdas/python/common/requirements-dev.txt
@@ -33,7 +33,7 @@ botocore==1.43.78
     #   s3transfer
 botocore-stubs==1.43.14
     # via boto3-stubs
-certifi==2026.6.17
+certifi==2026.10.19
     # via requests
 cffi==2.0.0
     # via cryptography

diff --git a/backend/dietitian-app/lambdas/python/common/requirements.txt b/backend/dietitian-app/lambdas/python/common/requirements.txt
@@ -16,7 +16,7 @@ botocore==1.43.78
     # via
     #   boto3
     #   s3transfer
-certifi==2026.6.17
+certifi==2026.10.19
     # via requests
 cffi==2.0.0
     # via

diff --git a/backend/dietitian-app/lambdas/python/compact-configuration/requirements-dev.txt b/backend/dietitian-app/lambdas/python/compact-configuration/requirements-dev.txt
@@ -11,7 +11,7 @@ botocore==1.43.78
     #   boto3
     #   moto
     #   s3transfer
-certifi==2026.6.17
+certifi==2026.10.19
     # via requests
 cffi==2.0.0
     # via cryptography

diff --git a/backend/dietitian-app/lambdas/python/custom-resources/requirements-dev.txt b/backend/dietitian-app/lambdas/python/custom-resources/requirements-dev.txt
@@ -11,7 +11,7 @@ botocore==1.43.78
     #   boto3
     #   moto
     #   s3transfer
-certifi==2026.6.17
+certifi==2026.10.19
     # via requests
 cffi==2.0.0
     # via cryptography

diff --git a/backend/dietitian-app/lambdas/python/data-events/requirements-dev.txt b/backend/dietitian-app/lambdas/python/data-events/requirements-dev.txt
@@ -11,7 +11,7 @@ botocore==1.43.78
     #   boto3
     #   moto
     #   s3transfer
-certifi==2026.6.17
+certifi==2026.10.19
     # via requests
 cffi==2.0.0
     # via cryptography

diff --git a/backend/dietitian-app/lambdas/python/disaster-recovery/requirements-dev.txt b/backend/dietitian-app/lambdas/python/disaster-recovery/requirements-dev.txt
@@ -11,7 +11,7 @@ botocore==1.43.78
     #   boto3
     #   moto
     #   s3transfer
-certifi==2026.6.17
+certifi==2026.10.19
     # via requests
 cffi==2.0.0
     # via cryptography

diff --git a/backend/dietitian-app/lambdas/python/provider-data-v1/requirements-dev.txt b/backend/dietitian-app/lambdas/python/provider-data-v1/requirements-dev.txt
@@ -11,7 +11,7 @@ botocore==1.43.78
     #   boto3
     #   moto
     #   s3transfer
-certifi==2026.6.17
+certifi==2026.10.19
     # via requests
 cffi==2.0.0
     # via cryptography

diff --git a/backend/dietitian-app/lambdas/python/purchases/requirements-dev.txt b/backend/dietitian-app/lambdas/python/purchases/requirements-dev.txt
@@ -76,7 +76,7 @@ mdurl==0.1.2
     # via markdown-it-py
 moto[dynamodb,s3]==5.2.2
     # via -r requirements-dev.in
-msgpack==1.2.1
+msgpack==1.2.3
     # via cachecontrol
 packageurl-python==0.17.6
     # via cyclonedx-python-lib

diff --git a/backend/dietitian-app/lambdas/python/search/requirements-dev.txt b/backend/dietitian-app/lambdas/python/search/requirements-dev.txt
@@ -11,7 +11,7 @@ botocore==1.43.78
     #   boto3
     #   moto
     #   s3transfer
-certifi==2026.6.17
+certifi==2026.10.19
     # via requests
 cffi==2.0.0
     # via cryptography

diff --git a/backend/dietitian-app/lambdas/python/search/requirements.txt b/backend/dietitian-app/lambdas/python/search/requirements.txt
@@ -4,7 +4,7 @@
 #
 #    pip-compile --no-emit-index-url --no-strip-extras lambdas/python/search/requirements.in
 #
-certifi==2026.6.17
+certifi==2026.10.19
     # via
     #   opensearch-py
     #   requests

diff --git a/backend/dietitian-app/lambdas/python/staff-user-pre-token/requirements-dev.txt b/backend/dietitian-app/lambdas/python/staff-user-pre-token/requirements-dev.txt
@@ -11,7 +11,7 @@ botocore==1.43.78
     #   boto3
     #   moto
     #   s3transfer
-certifi==2026.6.17
+certifi==2026.10.19
     # via requests
 cffi==2.0.0
     # via cryptography

diff --git a/backend/dietitian-app/lambdas/python/staff-users/requirements-dev.txt b/backend/dietitian-app/lambdas/python/staff-users/requirements-dev.txt
@@ -11,7 +11,7 @@ botocore==1.43.78
     #   boto3
     #   moto
     #   s3transfer
-certifi==2026.6.17
+certifi==2026.10.19
     # via requests
 cffi==2.0.0
     # via cryptography

diff --git a/backend/dietitian-app/requirements-dev.txt b/backend/dietitian-app/requirements-dev.txt
@@ -12,7 +12,7 @@ cachecontrol[filecache]==0.14.4
     # via
     #   cachecontrol
     #   pip-audit
-certifi==2026.6.17
+certifi==2026.10.19
     # via requests
 charset-normalizer==3.4.7
     # via requests
@@ -28,7 +28,7 @@ defusedxml==0.7.1
     # via py-serializable
 faker==40.36.0
     # via -r requirements-dev.in
-filelock==3.29.4
+filelock==4.2.4
     # via cachecontrol
 idna==3.18
     # via requests
@@ -40,7 +40,7 @@ markdown-it-py==4.2.0
     # via rich
 mdurl==0.1.2
     # via markdown-it-py
-msgpack==1.2.1
+msgpack==1.2.3
     # via cachecontrol
 packageurl-python==0.17.6
     # via cyclonedx-python-lib

diff --git a/backend/multi-account/control-tower/requirements-dev.txt b/backend/multi-account/control-tower/requirements-dev.txt
@@ -38,7 +38,7 @@ markdown-it-py==4.2.0
     # via rich
 mdurl==0.1.2
     # via markdown-it-py
-msgpack==1.2.1
+msgpack==1.2.3
     # via cachecontrol
 packageurl-python==0.17.6
     # via cyclonedx-python-lib

diff --git a/backend/social-work-app/requirements-dev.txt b/backend/social-work-app/requirements-dev.txt
@@ -40,7 +40,7 @@ markdown-it-py==4.2.0
     # via rich
 mdurl==0.1.2
     # via markdown-it-py
-msgpack==1.2.1
+msgpack==1.2.3
     # via cachecontrol
 packageurl-python==0.17.6
     # via cyclonedx-python-lib