chore(deps): update all known-vulnerable dependencies

[pjdoland]

Summary

A dependency audit (pip-audit for Python, yarn npm audit --environment all --all --recursive for JavaScript) found known vulnerabilities across both stacks: 6 vulnerable Python packages in a fresh environment resolve, and 304 JavaScript advisories (11 critical, 105 high, 152 moderate, 36 low) across 20 unique packages in the lockfile. This PR updates every one of them; both audits now report zero known vulnerabilities.

Solution

Python raises pyproject floors so fresh installs cannot resolve the vulnerable releases: jupyter_server>=2.20.0 (PYSEC-2026-366), mcp>=1.28.1 (CVE-2026-59950), and mistune>=3.3.0 (the PYSEC-2026-2210..2218/2652 batch) for direct dependencies, plus new transitive security floors following the file's existing urllib3 precedent: tornado>=6.5.7 (GHSA-pw6j-qg29-8w7f), starlette>=1.3.1 (PYSEC-2026-248/249), pydantic-settings>=2.14.2 (GHSA-4xgf-cpjx-pc3j), and aiohttp>=3.14.1 (PYSEC-2026-2107..2113). Each new floor was checked against the parents' own constraints (mcp, litellm, jupyter_server, jupyterlab); none conflict, and the documented python-dotenv/litellm pin situation is untouched.

JavaScript: 19 of the 20 vulnerable packages had fixes inside the ranges the lockfile already allows, so they are handled by an in-range lockfile refresh (yarn up -R), with no package.json dependency changes. The one exception is serialize-javascript: every fixed release is on the 7.x line while its sole dependent (terser-webpack-plugin, via @jupyterlab/builder) requests ^6.0.1, so a scoped resolutions entry ("serialize-javascript@^6.0.1": "^7.0.5") forces it across the major, matching the existing minimatch/prismjs resolution style.

Two lockfile notes to preempt supply-chain suspicion: the remaining churn is direct re-resolution fallout of webpack 5.108.4 and @babel/core 7.29.7 (webassemblyjs, enhanced-resolve, browserslist chain, etc.), and webpack 5.108.4 introduces minimizer-webpack-plugin, which is the webpack org's rename of terser-webpack-plugin (same repo lineage and maintainers), not a typosquat.

Testing

No new tests: for a constraints-only bump the existing suites are the test. On the upgraded stack: pytest 1307 passed, tsc --noEmit clean, lint clean, jest 376 passed, and the webpack build succeeds on webpack 5.108.4. A live JupyterLab session on the rebuilt bundle and upgraded server stack (jupyter-server 2.20, tornado 6.5.7, mistune 3.3) was driven with Playwright: zero console errors after load, chat sidebar renders, settings panel opens and populates. Both audits re-run clean: pip-audit reports no known vulnerabilities and yarn npm audit reports 0 across all severities.

Risks / follow-ups

serialize-javascript@7 declares engines.node >= 20 (v6 declared none); Yarn warns rather than fails on engines, local builds are on Node 22, and the repo declares no engines field, so this only matters for contributors building on Node 18, worth a contributor-docs note at some point. litellm's lower bound stays at 1.83.7 with its documented latent CVE-2026-40217 gap unchanged (the fix release has still not shipped to PyPI; NBI does not expose the affected proxy endpoints). The fuzy-jon==0.1.0 exact pin was left alone as it has no known advisories.

[mbektas]

LGTM, thanks!