fix(security): resolve Dependabot, Scorecard and CodeQL alerts

[dekobon]

Resolves the open GitHub security alerts.

Dependency advisories

Package	Change	Advisory	Alerts
jupyterlab	4.6.3 → 4.6.4	GHSA-6966-vjj6-99xv, GHSA-3325-v43h-43rv, GHSA-3jqq-pw4j-pqcj	Dependabot #57–#60, #66–#69
notebook	7.6.2 → 7.6.3	GHSA-6966-vjj6-99xv	Dependabot #58, #67
jupyter-server	2.20.0 → 2.21.1	PYSEC-2026-4054 / GHSA-c3mw-737p-c7g2	Scorecard #776
faster-hex (Rust)	0.10.0 → 0.10.1	RUSTSEC-2026-0306 (unsound)	Scorecard #776

The Jupyter packages are transitive through the examples extra only, so only uv.lock and requirements/examples.txt move. faster-hex ships in bca through gix-hash, which calls only the checked hex_decode / hex_encode. The defmt 0.3.100 lock entry it adds is behind a feature nothing enables.

An OSV batch query over all 13 lockfiles in the repo (Cargo, uv, npm) reports 0 hits on this branch, and all of #776's advisories on main. Scorecard only scans main, so #776 closes on its first run after merge.

cargo-deny missed the Rust advisory

The cargo-deny CI job passed on main with faster-hex 0.10.0 for over two weeks: its default unsound scope covers direct dependencies only. deny.toml now sets unsound = "all". With that setting the check fails on main's lockfile and passes here.

CodeQL #799–#803 (rust/hard-coded-cryptographic-value)

False positives. CodeQL's Rust taint tracking is field-insensitive on a struct, so the SECONDS_PER_* window constants and parse_iso8601's zero accumulator, written into Options, tainted Options::author_hash_key. That key is only ever built by AuthorHashKey::new from caller-supplied bytes.

Rather than leave them dismissed, .github/codeql/extensions/rust-models adds a repo-local model pack that puts the field in CodeQL's excludeFieldTaintStep extensible predicate. That removes only the "read any field of a tainted struct" shortcut. Code scanning loads packs in that directory automatically. A comment on the field records that a rename must update the model.

Verification

• make pre-commit: BCA_GATE: pass
• cargo deny check: advisories, bans, licenses, sources ok
• CodeQL docs(parser): numeric -t/--type filter silently matches by grammar-unstable kind_id #799–big-code-analysis: read_file_with_eol strips UTF-16 BOM then accepts UTF-16 body as garbage #803, reproduced locally with CodeQL 2.27.1 (the version CI uses) on a git archive of this branch. This PR's own CodeQL result can't show the fix: PR runs are diff-informed and report only alerts on changed lines, and the alerts' source lines are unchanged.
  • Database built without a code-scanning config: 5 results, the same five alerts as on main.
  • Database built with --codescanning-config, as codeql-action does, and the query run with no extra flags: 0 results. The CLI copied extensions/rust-models/models/vcs.model.yml into the database's internal extension pack.
  • The CI log for this PR shows the same internal pack being resolved, with the same harmless warning that its extensions/**/*.yaml pattern (the .yaml twin of *.yml) matched nothing.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.02%. Comparing base (9008842) to head (95e6e4b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1518   +/-   ##
=======================================
  Coverage   98.01%   98.02%           
=======================================
  Files         359      359           
  Lines       96210    96210           
  Branches    95779    95779           
=======================================
+ Hits        94303    94312    +9     
+ Misses       1222     1214    -8     
+ Partials      685      684    -1     

Flag	Coverage Δ
python	100.00% <ø> (ø)
rust	98.01% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/vcs/options.rs	98.91% <ø> (ø)

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.