deps: triage the post-v0.3.0 Dependabot group PRs (#144, #145, #146)

[tyler-rich]

Triages the three grouped Dependabot PRs opened against dev after the v0.3.0 release and reapplies their content by hand rather than merging them as-built. None of #144, #145 or #146 should be merged — close them once this lands.

All three were correctly based on dev: every head branch carries the /dev/ target-branch segment and no timeline carries automatic_base_change_succeeded, so neither the security-update-on-main case (#120) nor the auto-retarget case (#126/#127/#128) applies.

#144 — backend (pip): applied in full

• fastapi 0.140.13 → 0.141.1 — adds an app.frontend() dev-server convenience Scrye does not use, plus its 0.141.1 fix. No routing, dependency-injection or response-model change.
• uvicorn[standard] 0.51.0 → 0.52.0 — adds an opt-in experimental --http zttp parser that upstream marks not-for-production, and a websockets header fix. docker/entrypoint.sh passes no --http flag, so the default parser is unchanged.
• ruff 0.16.0 → 0.16.1 (dev extra).

backend/requirements.lock regenerated with the pinned uv 0.8.17 command from CONTRIBUTING.md § Backend dependency lock — the step Dependabot does not do, so its branch would have failed CI's drift gate. The lock diff is exactly those two packages and their hashes; starlette holds at 1.3.1, confirming FastAPI 0.141.1 still accepts the pin carried for CVE-2025-62727 / CVE-2026-48818 / CVE-2026-54283. The stale # … 0.51.0 is the current release comment Dependabot left behind is fixed too.

#146 — github-actions: not a version bump

The PR moves codeql-action/init and .../analyze to a new SHA while leaving the comment at # v4.37.4. Resolving the tag upstream rather than trusting the description shows both SHAs are the same release:

ea14db8afdef5d462e69d78c4ca45002d4522418  refs/tags/v4.37.4
f205ea1c3313d32999d8d6a48b4f6530d4437b38  refs/tags/v4.37.4^{}

codeql-action publishes annotated tags, so the old pin named the tag object and the new one names the commit it dereferences to. Applied, because a SHA-pin is meant to name an immutable commit.

• Not an outage fix — Actions dereferences a tag object, and CodeQL has been green on the old pin since ci: migrate CodeQL from default setup to a committed workflow #141.
• No code-scanning change — same release ⇒ same bundle (2.26.2), same security-extended suite.
• Nothing on the tag-gated publish path moved. codeql.yml runs on PRs to dev, so this PR's own CI exercises the corrected pin.
• All eight other pinned actions were re-resolved and already name commits — they publish lightweight tags, so this was a single-repo trap, not systemic.

#145 — frontend (npm): 8 applied, 1 narrowed, 11 held

The Mantine/React ignores held — no locked major was proposed; @mantine/* moved 7.15.2 → 7.17.8, a minor inside v7.

Applied: @mantine/core/form/hooks 7.17.8, @tabler/icons-react 3.46.0, @testing-library/react 16.3.2, @testing-library/jest-dom 7.0.0, postcss-preset-mantine 1.18.0, globals 17.8.0, prettier 3.9.6.

The two majors were checked, not waved through: jest-dom 7 needs @testing-library/dom as a peer (already direct at 10.4.1) and Node ≥22 (CI is on 24), and removes no matchers; globals 17 was inspected for a shrunken set rather than trusted to a green lint run (1191 browser globals, window/document/fetch present).

Narrowed: @types/node 22.20.0 → 24.13.3, not the proposed 26.1.2. Its major tracks Node's and the SPA builds on Node 24; tsconfig.node.json sets "types": ["node"], so types ahead of the pinned runtime feed APIs the build lacks into the type-aware ESLint gate — the same failure mode that put @types/react* in the ignore list.

Held back (the deferred #86 sweep): typescript 7, eslint 10, @eslint/js 10, typescript-eslint 8.65, vite 8, @vitejs/plugin-react 6, vitest 4, jsdom 30, eslint-plugin-react-hooks 7, eslint-plugin-react-refresh 0.5. Not blocked by any ignore rule and not unwanted — they all land on the type-aware ESLint gate and several cannot move alone. typescript-eslint 8.19 → 8.65 is a minor and looks routine in isolation; it is held anyway because its support matrix pairs with the TypeScript version the sweep will move.

Heads-up on the diff: Prettier 3.9 collapses short union types onto one line instead of the leading-| form, so three source files (src/api/scans.ts, src/api/targets.ts, src/pages/Dashboard.tsx) show whitespace-only edits — 17 lines, no semantic change.

Alongside

• .github/dependabot.yml gains an @types/node major ignore beside the @types/react* ones, for the identical reason. The comment records what is deliberately not ignored: the toolchain majors are wanted work and should keep being surfaced.
• docs/ROADMAP.md's frontend: bump the frontend-dependencies group across 1 directory with 25 updates #86 sweep list refreshed to the versions frontend: bump the frontend-dependencies group in /frontend with 20 updates #145 surfaced, plus the four members missing from the original list.

Verification

• Backend: ruff + black --check clean, .env.example in sync, lock stable under recompile (drift gate passes), 731 passed / 8 skipped on CPython 3.14.6.
• Frontend: ESLint, Prettier, 79 tests / 21 files, npm run build all pass. npm audit's only finding is the pre-existing react-router HIGH (GHSA-qwww-vcr4-c8h2 (react-router RSC-mode CSRF bypass) — fixed by the 7.18.2 backport, not the 8.3.0 major #123), unchanged here.
• Versions held at 0.3.0 in all five places that carry one — the regenerations moved neither.

One note for whoever runs the suite locally next: it cannot run on CPython 3.14.0rc2 (what uv python install 3.14 resolves to in a sandbox). typing._eval_type() gained prefer_fwd_module between rc2 and final and pydantic 2.13.4 passes it unconditionally, so every model construction raises at import. That was confirmed interpreter-caused, not bump-caused, by reproducing it with the pre-bump pins before concluding anything.

See docs/ARCHIVE.md § Deviations for the full record of this triage.