Resolve 69 open Dependabot vulnerabilities and set an update cadence

[lucaosti]

Context

GitHub reports 69 open Dependabot vulnerabilities on the default branch: 3 critical, 33 high, 25 moderate, 8 low.

https://github.com/BitPolito/bitcoin-academy/security/dependabot

Issue #90 previously resolved all open alerts (merged May 2026), so this backlog has accumulated since — a sign that dependency updates are not part of the routine.

Tasks

• Triage all 69: which are reachable from application code, which are transitive and inert, which are dev-only
• Fix all critical and high alerts that are reachable
• For anything left open, record why in a comment here — an accepted risk stated out loud is fine, an ignored alert is not
• Check all three dependency trees: services/ai (uv/pip), apps/web (npm), workers/qvac-service (npm)
• Verify the test suites pass after upgrades; ML and PDF dependencies in particular have a history of behavioural changes between versions
• Re-run the RAG evaluation suite if any parsing, embedding or ML dependency changes — a silent quality regression is the real risk here
• Decide and configure a routine: grouped Dependabot PRs on a schedule, so this does not accumulate again

Acceptance criteria

• Zero critical and high alerts, or each remaining one has a written justification
• All test suites green after the upgrades
• RAG evaluation shows no regression where ML/parsing dependencies moved
• An agreed, configured update cadence

Note

Prioritise reachability over raw count. Three critical alerts in a transitive dev-only dependency matter less than one high alert in the PDF parsing path that processes untrusted user uploads — and this application parses user-supplied PDFs, PPTX and DOCX, which is exactly the kind of input that makes parser vulnerabilities exploitable.