bump dependencies to make dependabot happier

[yangm2]

What type of PR is this? (check all applicable)

• Refactor
• Feature
• Bug Fix
• Optimization
• Documentation Update
• Infrastructure
• Maintenance

Description

address ...

• https://github.com/codeforpdx/tenantfirstaid/security/dependabot/46
• https://github.com/codeforpdx/tenantfirstaid/security/dependabot/47
• https://github.com/codeforpdx/tenantfirstaid/security/dependabot/53
• https://github.com/codeforpdx/tenantfirstaid/security/dependabot/54
• https://github.com/codeforpdx/tenantfirstaid/security/dependabot/55

Related Tickets & Documents

• Related Issue #
• Closes #

QA Instructions, Screenshots, Recordings

Please replace this line with instructions on how to test your changes, a note on the devices and browsers this has been tested on, as well as any relevant images for UI changes.

Added/updated tests?

• Yes
• No, and this is why: bumping dependencies
• I need help with writing tests

Documentation

• If this PR changes the system architecture, Architecture.md has been updated

[optional] Are there any post deployment tasks we need to perform?

[yangm2]

@claude review this change

[claude]

Claude finished @yangm2's task in 1m 45s —— View job

---

Code Review

• Gather context: review the diff
• Analyze dependency changes
• Post review feedback

---

This is a straightforward dependency maintenance PR. Only lock files are modified — no changes to pyproject.toml or package.json, so the updates are being pulled in by bumping the resolved versions via uv lock and npm install.

Frontend (package-lock.json)

The only real change here is dompurify 3.3.0 → 3.3.2, which is a security-focused HTML sanitizer. The remaining diff is formatting/metadata noise (peer flag reordering). Good bump.

Backend (uv.lock)

Most packages received routine patch/minor updates. A few worth calling out:

Package	Old	New	Notes
google-cloud-vectorsearch	0.5.0	0.7.0	Two minor versions — larger jump
langsmith	0.7.6	0.7.16	Ten patch versions
openai	2.21.0	2.26.0	Five minor versions
websockets	15.0.1	16.0	Major version bump
grpcio / grpcio-status	1.78.1	1.78.0	Downgrade (minor)

websockets 15.0.1 → 16.0: This is a major version. websockets 16.0 did introduce some API changes, but since it's a transitive dependency (pulled in via Google Cloud / gRPC libs), this should be fine as long as the consuming libraries have been updated accordingly — which they appear to have been.

grpcio / grpcio-status 1.78.1 → 1.78.0: A minor version downgrade. This is expected when dependency resolution changes; 1.78.0 is the version that satisfies all updated constraints. Not a concern.

Overall Assessment

The changes look correct and appropriate. All hashes/integrity values are updated consistently in the lock files. Since only lock files were modified, it'd be worth confirming CI passes to validate nothing regressed. The PR directly targets the 5 dependabot alerts mentioned in the description.

LGTM once CI is green. ✓