chore(deps): clear 108 Dependabot alerts across docs, canary, and examples

[kylehounslow]

What

Clears 108 of the 111 open Dependabot alerts on main. Every change is lockfile-level or a within-major floor bump, so no breaking upgrade. The remaining 3 (aws/cdk brace-expansion) are bundled inside aws-cdk-lib and blocked upstream on aws/aws-cdk#38932.

Fix

One commit per manifest.

docs/ (26): raised direct and override floors: astro ^7.1.1 -> ^7.2.8 (critical GHSA-26w7-cxv4-gfx2, GHSA-376h-93r7-7g6f), undici override ^7.24.0 -> ^7.29.1 (10 advisories), sharp override ^0.35.0 -> ^0.35.4, vitest / @vitest/* ^4.0.18 -> ^4.1.11. Transitives devalue 5.9.4, js-yaml 4.3.2, svgo 4.1.0 float to patched.

docs/starlight-docs/ (26): lockfile-only: astro 7.3.5, undici 8.11.2, devalue 5.9.4, js-yaml 4.3.2, sharp 0.35.5, svgo 4.1.0, dompurify 3.4.16.

http-cache-semantics 4.2.0 -> 4.3.0, both docs lockfiles (GHSA-ch52-4w7c-c8xp): this clears the alert by version range only. The maintainer closed the report as not a vulnerability (kornelski/http-cache-semantics#56, citing RFC 9111 section 7.3) and 4.3.0 doesn't change max-stale handling. The starlight-docs entry is a single-package lockfile edit, because a full npm update there prunes the optional peer @astrojs/markdown-remark, which the build needs.

docker-compose/agent-eval-canary (3): urllib3 2.8.0.

examples/ (53), lockfile-only:

• agent-evals/genai-sdk (26): aiohttp 3.14.3, anyio 4.14.2, cryptography 50.0.2, pyjwt 2.15.1, soupsieve 2.10, urllib3 2.8.0
• langchain/bedrock-financial-assistant (5): anyio 4.14.2, urllib3 2.8.0
• plain-agents/weather-agent (5): anyio 4.14.2, urllib3 2.8.0
• strands/code-assistant (17): cryptography 50.0.2, pyjwt 2.15.1, urllib3 2.8.0

Validation

• I checked every open alert against the full set of vulnerable_version_range entries in its GHSA advisory. On this branch the only versions still in range are the 3 aws/cdk brace-expansion ones.
• docs/: npm ci clean, npm run build 148 pages, npm test 557 passed (28 files)
• docs/starlight-docs/: npm ci clean, npm run build 148 pages on a clean dist
• All 5 Python projects: uv sync --locked passes and every imported module loads (python:3.12-slim). weather-agent imports boto3 and httpx without declaring them in pyproject.toml. That's already the case on main and this PR doesn't touch it.

The 108 cleared alerts also cover the bumps in these open Dependabot PRs: #406, #446, #447, #449, #451, #452, #454, #455, #458, #459, #460, #461, #462, #468, #469, #472, #473, #475, #386, #389, #392. Two of those stop short of the patched floor: #458 (devalue 5.9.2) and #406 (dompurify 3.4.13). This PR also supersedes #402.

The docs/ lockfile was regenerated with npm 11, because npm 10.9.x crashes with an edgesOut error when it hits the overrides block. The lockfile is lockfileVersion 3 and npm ci installs it cleanly under npm 10.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.62%. Comparing base (5c771b9) to head (91c9d8d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #476   +/-   ##
=======================================
  Coverage   55.62%   55.62%           
=======================================
  Files           4        4           
  Lines         169      169           
  Branches       48       47    -1     
=======================================
  Hits           94       94           
  Misses         74       74           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kylehounslow]

Pushed 2 more commits to clear the Mend findings that have a fix available:

• examples/agent-evals/genai-sdk: strands-agents-tools 0.2.22 -> 0.8.9 (CVE-2026-18394, CVE-2026-15746), multidict 6.7.1 -> 6.9.1 (CVE-2026-104874), click 8.3.1 -> 8.5.0 (CVE-2026-7246)
• examples/langchain/bedrock-financial-assistant: langgraph-sdk 0.4.2 -> 0.4.5 (CVE-2026-104873)

Both are lockfile-only. strands-agents-evals 0.1.15 already allows strands-agents-tools <1.0.0, so no direct dep changes. uv sync --locked and an import check pass on python 3.12.

Mend will still fail on the rest. All of these are on main today, and none have a fix this repo can pick up without an override:

• brace-expansion 5.0.9 (aws/cdk, CVE-2026-102276/102277/102278): bundled inside aws-cdk-lib, so npm overrides can't reach it. Tracked upstream in (core): Bump bundled brace-expansion to 5.0.12 to address CVE-2026-102276 / CVE-2026-102278 aws/aws-cdk#38932
• zod 4.6.5 (CVE-2023-54404): the advisory covers everything through 4.6.5, and there's no patched release yet. Main has 4.4.3, which is also in range.
• katex 0.16.47 (CVE-2026-103923): fixed in 0.18.2, but mermaid pins ^0.16.47, including the latest 12.1.0.
• postcss-selector-parser 6.1.4 (CVE-2026-104844): fixed in 7.1.6, but @expressive-code/core 0.44.2 (latest) pulls postcss-nested ^6, which stays on 6.x.

The Mend summary reports "Base branch total remaining vulnerabilities: 0", even though main has these same versions, so it labels all of them as new to this PR. Happy to add overrides for katex and postcss-selector-parser if you'd rather have Mend green. Both would force a version outside the range the parent declares, so I'd rather wait for mermaid and expressive-code to bump.

[kylehounslow]

Correction to my last comment: the click and multidict CVEs also showed up in two other examples, so they were still open after that push. 2 more commits fix them:

• examples/plain-agents/weather-agent: click 8.3.1 -> 8.5.0 (CVE-2026-7246)
• examples/strands/code-assistant: multidict 6.7.1 -> 6.9.1 (CVE-2026-104874)

Both are lockfile-only, and uv sync --locked passes on python 3.12. After this push, Mend should only flag the findings that are already on main and have no in-repo fix: brace-expansion, zod, katex, and postcss-selector-parser.

[kylehounslow]

Pushed one more commit for the two docs findings: overrides in docs/starlight-docs for katex ^0.18.2 (CVE-2026-103923) and postcss-selector-parser ^7.1.6 (CVE-2026-104844).

Both versions are outside what the parent declares. mermaid pins katex ^0.16.47, and postcss-nested 6.x pins postcss-selector-parser ^6.1.1. So I compared a build of this commit against the previous one:

• Both build 148 pages.
• After normalizing chunk hashes, the HTML is identical. CSS is byte-identical, so postcss-selector-parser 7 doesn't change the expressive-code output.
• Only the mermaid JS chunks that bundle katex differ. mermaid calls katex.renderToString only for $$ math in diagram labels, and no page uses that.
• katex breaking changes: 0.17.0 changed the internal __defineFunction API, which mermaid doesn't call. 0.18.0 prefixes CSS classes, so a future diagram that uses math and relies on katex CSS could render unstyled.

Mend should now flag only brace-expansion (bundled in aws-cdk-lib, aws/aws-cdk#38932) and zod (no release covers it yet; 4.6.5 is the latest). Both are already on main. I can drop the override commit if you'd rather wait for mermaid and expressive-code to move.

[kylehounslow]

Some mend findings still remain but let's get them as follow-up instead: https://github.com/opensearch-project/observability-stack/pull/476/checks?check_run_id=111941813929

[ps48]

Mend check is still failing should we also add these?
https://github.com/opensearch-project/observability-stack/pull/476/checks?check_run_id=111941813929