[fakayser]

Addresses the 19 Dependabot alerts and CodeQL alerts #31/#32 with targeted Python dependency updates, secret logging hardening and corrected Markdown heading checks in the CLI and pinned schema repository.

• Lock certifi 2026.10.19, PyJWT 2.15.0, urllib3 2.8.0 and pytest 9.0.3. Update pytest-cases to 3.10.1 for pytest 9 compatibility; no other package versions change.
• Exempt only certifi from uv's one-week cooldown so the critical CA trust-store update can be installed immediately.
• Remove the five debug statements exposing registry contents and use constant messages for the three keyring operations that previously logged service names and secret paths.
• Cover setting, overwriting, reading, listing, deleting and cleaning secrets with a fake keyring at DEBUG level. Assert that values, registry entries, solution names and secret paths never appear in these logs.
• Strip innermost HTML tags repeatedly before creating Markdown heading anchors. Cover inline, nested, reintroduced and incomplete tags, the CodeQL example, Unicode and duplicate anchors.
• Pin datam8-model to 002aa65f6f127f91d06c8dc0fc4ea50ce75616fc, which applies the same heading-check correction and regressions. Schema definitions and generated types are unchanged.

Validation on CLI commit c3cfe4a:

• Frozen all-extras installation and uv lock --check passed.
• All five focused plugin/secret/SQL regression tests passed.
• Ruff and pinned ty 0.0.60 passed.
• Node 24 CLI documentation/scope tests: 9 passed; schema documentation tests: 6 passed. Documentation checks found no problems.

GitHub validation on this same CLI commit: CI passed, including the full Linux suite (459 passed, no skips), wheel installation, API and offline ODCS smoke checks. All three CodeQL analyses and the PR CodeQL check passed.

Frontend consumer commit dbe1cdfb62686d1da0af648044cb1944492c5a21 pins this combined CLI revision on codex/security-hardening. Node 24 workspace typechecks, 216 web unit tests, seven targeted Playwright tests with the real backend and disposable fixtures, ci:gates including generation/output verification, and frontend documentation checks passed. No frontend production build or desktop packaging run was repeated for this submodule-only update.

Dependency alerts close after merge and rescan; verify all 19, particularly GHSA-gvp8-978c-rx2q, which lacks a first-patched version in its advisory. No CLI, REST or plugin interface changes.

Integration order: schema PR #22 → CLI PR #49 → frontend PR #65. Update downstream submodule pins if squash merging changes the retained commits.

Final integration commit fa11b65 pins the merged schema main commit. Its CI and CodeQL checks passed before merge.