[Open-Squilla]

Scope

Refresh vulnerable locked dependencies that currently fail the mandatory security audit, independently of the scroll-boundary change in #1985.

Scope boundary: six Python, WebUI, and Electron dependency manifest/lock files. Keep the existing audit policy and CI gates intact.

Non-goals: application behavior changes, broad dependency modernization, and the #1985 CSS change.

Branch

Base branch: main

Target exception: N/A

Issue

Linked issue: None

If None, reason: remediation of the mandatory dependency audit failure in merge-group run 40274457423; this unblocks #1985.

Release Note

Release note: Update vulnerable Python, Electron, HTTP parsing, and frontend test dependencies to patched versions.

Changes

• Electron 42.11.16; fast-uri 3.1.9 in both npm trees; retain the two Undici major lines at 6.29.1 and 7.30.1.
• Happy DOM 21.0.4. Its default iframe/CSS network-load restrictions remain intact.
• Brotli 1.2.1, brotlicffi 1.2.1.0, filelock 4.2.1, pypdf 6.21.2, and setuptools 84.1.0. Raise direct runtime floors and constrain optional/build transitive packages without adding them to the base install.
• Regenerate locks selectively; no unrelated package updates.

Tests

• Complete unchanged pinned dependency audit: 0 errors, 0 vulnerable records; full coverage of 207 Python package versions and both npm dependency trees.
• Pinned uv 0.12.15 lock --check --offline: 208 packages resolved, manifest and lock consistent.
• WebUI: 309 focused DOM/render tests, 25 contract-tooling tests, TypeScript configuration and Vue type checks passed.
• Electron: clean install and build; downloader proxy/checksum, renderer protocol, navigation/reload tests passed. Exact Electron 42.11.16 passed hidden disposable-profile startup, popup/session isolation and guarded host-navigation acceptance.
• Python: six isolated compatibility/security probes passed for both Brotli implementations, pypdf read/write, Hugging Face cross-process file locks, setuptools namespace validation and PyInstaller import.
• Product Python cases: 11 Brotli-streaming/PDF tests passed (227 unrelated cases deselected), using the patched packages and isolated state.
• git diff --check passed. Broader platform and packaging verification runs through required CI.

Regression tests: not needed; dependency-only updates are exercised by existing focused compatibility/security suites and the unchanged complete dependency audit.

Maintainer Live Check

Maintainer live check: no

Surface: N/A

Maintainer-only note: all checks use synthetic data and isolated dependencies, with no provider credentials or personal app profiles.

Safety

No secrets, user transcripts, private fixtures, local test outputs, or AI session artifacts are included.

Third-Party Origin

Third-party origin: direct dependency

Details if non-none: version updates of existing registry dependencies, governed by their upstream package licenses; no upstream source is copied or vendored. Registry URLs and integrity hashes remain in the lockfiles; the existing dependency packaging notice applies.

Documentation Changes

• Links point to existing repository files or stable external pages.
• Code fences and Markdown tables render correctly on GitHub.
• Examples avoid real secrets, local private paths, and private transcripts.