Outdated dependencies in container image (tar, elysia, pillow, cryptography)

[upmcplanetracker]

there are a few outdated Node and Python dependencies with available upstream fixes that have real-world consequences with a (possible) public facing container like convertx.

Node.js (tar) - CVE-2026-59873 (Critical - gzip bomb DoS) & CVE-2026-59874 (High - malformed tar header DoS). - bump to >= 7.5.19

Node.js (elysia) - CVE-2026-30837 (High - string URL format ReDoS) - bump to >= 1.4.26

Python (pillow) - CVE-2026-54058, CVE-2026-59197, CVE-2026-59205, and more involving memory leaks, heap writes, and parsing DoS vectors. - bump to >= 12.3.0

Python (cryptography) - CVE-2026-69247 - >= 50.0.0

the fixes should be rather simple to mitigate these real-world vulnerabilities ty.

[C4illin]

fixed all I think except elysia. The newest version doesn't work with bun v1.2.2. See #605

[upmcplanetracker]

tysm!