chore(deps): consolidate PRs #116-126, fix rkyv/brace-expansion/nanoid advisories

[pacphi]

Summary

Consolidates 8 of the 11 open Dependabot PRs into a single branch, then runs a full ecosystem security audit and fixes what it finds.

Superseded PRs

PR	Package	Bump	Area
#124	bytes	1.11.1 → 1.12.1	Rust (workspace)
#122	http-body-util	0.1.3 → 0.1.4	Rust (finima-api)
#120	ruvector-sona	0.2.0 → 0.2.1	Rust (finima-analysis, finima-categorize)
#125	@hookform/resolvers	5.4.0 → 5.7.1	Frontend
#118	@playwright/test	1.62.0 → 1.62.1	Frontend
#123	@vitejs/plugin-react	6.0.2 → 6.0.5	Frontend
#121	typescript-eslint	8.60.0 → 8.66.0	Frontend
#117	taiki-e/install-action	2.85.4 → 2.85.8	GitHub Actions (ci.yml, 3 occurrences)

Deferred (left open — not applied)

PR	Package	Bump	Reason
#119	@tanstack/react-table	8.21.3 → 9.0.0	8.21.3 is already the latest 8.x release, so this is a major-version rewrite (new column API), not a routine bump. Needs its own migration PR.
#116	candle-core	0.10.2 → 0.11.0	Blocked — see below
#126	candle-transformers	0.10.2 → 0.11.0	Blocked — see below

Why #116/#126 are blocked: finima-llm's mistralrs dependency pins candle-core = "^0.10.2" exactly. Bumping our own candle-core/candle-nn to 0.11 doesn't upgrade mistralrs's transitive candle — it creates two duplicate builds of candle-core/candle-nn (0.10.2 for mistralrs, 0.11.0 for finima-embed/finima-llm's direct use), which is exactly what the existing Cargo.toml comment says the 0.10 pin exists to prevent (doubled compile time, duplicate ML tensor types in the binary). This needs a mistralrs release that supports candle 0.11 before it can move.

Security audit

Ran cargo audit, pnpm audit, and checked GitHub Dependabot alerts (0 open).

Advisory	Package	Severity	Resolution
RUSTSEC-2026-0233 / -0234 / -0235	rkyv 0.8.16 (via ruvector-core)	UAF + OOB reads during deserialization	Fixed: cargo update -p rkyv@0.8.16 --precise 0.8.17 — in-range for ruvector-core's "0.8" requirement, lockfile-only.
RUSTSEC-2026-0235	rkyv 0.7.46 (via rust_decimal's optional rkyv feature)	OOB reads via Rc/Arc	Deferred, documented in audit-ignore. Confirmed unreachable: nothing in the workspace enables rust_decimal's rkyv feature (checked every crate in the resolved graph and every dependent's Cargo.toml), and the edge survives even a from-scratch cargo generate-lockfile, meaning it's a resolver artifact, never compiled. Will resolve once rust_decimal ships a release depending on rkyv 0.8.17+.
GHSA-rgw5-rvv9-x895	brace-expansion (transitive: eslint → minimatch)	High — DoS via unbounded intermediate arrays, bypasses the existing GHSA-jxxr-4gwj-5jf2 override	Fixed: widened the existing pnpm override from >=5.0.0 <5.0.6 to >=4.0.0 <5.0.9 → >=5.0.9.
GHSA-2v37-7h3g-55p8	nanoid (transitive: vite → postcss)	High — infinite loop when a custom generator's size is zero	Fixed: added pnpm override nanoid@<3.3.17 → >=3.3.17 <4. Constrained to the 3.x line deliberately — an unconstrained >=3.3.17 override resolved to nanoid 6.0.1 (a major bump postcss doesn't expect); pinning <4 keeps the same major while picking up the patched 3.3.18.

GitHub Dependabot alerts: 0 open (25 total, all previously resolved).

Pre-existing fixes

None — the working tree gates (fmt, clippy -D warnings, full test suite, frontend lint/typecheck/test/build) were already green on main going into this PR. The only local-environment snag (not a code issue) was a stale finima-postgres-1 container whose actual host port had drifted from 5432 to 5433 due to another project's container squatting on 5432 — resolved by pointing DATABASE_URL/TEST_DATABASE_URL at the correct port; no repo changes needed.

Verification

All commands mirror .github/workflows/ci.yml and .github/scripts/cargo-audit.sh exactly.

cargo fmt --all -- --check                                    # clean
cargo clippy --workspace --all-targets -- -D warnings          # clean, 0 warnings
cargo test --workspace                                         # all crates + doctests, 0 failures
bash .github/scripts/cargo-audit.sh                             # clean (8 documented exceptions)

pnpm install --frozen-lockfile                                  # reproduces lockfile
pnpm run lint                                                   # clean
pnpm exec tsc --noEmit                                          # clean
pnpm exec prettier --check 'src/**/*.{ts,tsx,css}'              # clean
pnpm run test -- --run                                          # 2 files, 9 tests, all pass
pnpm run build                                                  # builds (pre-existing >500kB chunk warning, unrelated)
pnpm audit                                                      # No known vulnerabilities found

[pacphi]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.