chore(deps): consolidate dependabot bumps #405-#420 + clear all security alerts (#421)

* chore(ci)(deps): bump setup-python, docker/login-action, docker/build-push-action

- actions/setup-python 6.3.0 -> 7.0.0 (#411)
- docker/login-action 4.2.0 -> 4.4.0 (#406)
- docker/build-push-action 7.2.0 -> 7.3.0 (#405)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SKNkeeo4ggQFfNWcFNLFtE

* chore(backend)(deps): bump python dependency group + setuptools

Consolidates dependabot #420 (13-package python group) and #418 (setuptools).

Applied: aiohttp 3.14.3, annotated-types 0.8.0, anyio 4.14.2,
certifi 2026.7.22, cffi 2.1.0, charset-normalizer 3.4.9, fastapi 0.141.1,
greenlet 3.5.4, mypy 2.3.0, ruff 0.16.0, setuptools 83.0.0,
websockets 16.1.1/17.0, yarl 1.24.5.

Held back: pydantic-core 2.47.0 — latest pydantic is still 2.13.4 and pins
pydantic-core==2.46.4 exactly, so the bump is uninstallable (deferred in
#378 and #404 for the same reason).

setuptools 83.0.0 clears GHSA-h35f-9h28-mq5c (medium).

ruff 0.16.0 formats python code blocks inside markdown, hence the two
README.md reformats.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SKNkeeo4ggQFfNWcFNLFtE

* chore(mcp)(deps): bump mcp 1.27.1 -> 1.29.0

Supersedes dependabot #410 (which targeted 1.28.1); uv resolved to the
latest satisfying 1.29.0.

Clears three HIGH advisories: GHSA-hvrp-rf83-w775, GHSA-jpw9-pfvf-9f58
(both <1.27.2) and GHSA-vj7q-gjh5-988w (<1.28.1).

443 mcp tests pass; ruff + mypy clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SKNkeeo4ggQFfNWcFNLFtE

* chore(frontend)(deps): bump prod + dev dependency groups, clear all advisories

Consolidates dependabot #419 (11 dev), #412 (3 prod), #417 (dompurify),
#416 (immutable) and #415 (body-parser).

Prod: dompurify 3.4.12, vue 3.5.40 (+ @vue/server-renderer 3.5.40 in
lock-step — it peer-pins vue exactly), vuetify 4.1.6.

Dev: eslint 10.8.0, eslint-plugin-vue 10.10.0, globals 17.8.0,
happy-dom 20.11.1, lint-staged 17.2.0, @playwright/test 1.62.0,
prettier 3.9.6, sass 1.102.0, terser 5.49.0, vite 8.2.0,
@vitejs/plugin-vue 6.0.8.

Transitive security fixes: immutable 5.1.9 (GHSA-v56q-mh7h-f735,
GHSA-xvcm-6775-5m9r), body-parser 2.3.0 (GHSA-v422-hmwv-36x6),
dompurify 3.4.12 (GHSA-c2j3-45gr-mqc4).

brace-expansion (GHSA-3jxr-9vmj-r5cp + GHSA-mh99-v99m-4gvg) was not
covered by any dependabot PR. It only survives as a nested 2.1.4 under
js-beautify -> {editorconfig,glob} -> minimatch@9, and 2.x has no patched
release. A blanket brace-expansion@5 override is NOT safe: minimatch@9
does `__importDefault(require("brace-expansion"))` and calls `.default()`,
but brace-expansion@5's CJS build exports an object `{EXPANSION_MAX,
EXPANSION_MAX_LENGTH, expand}` — so it would throw. Instead override
minimatch to ^10.2.5, which is written against the object export (eslint
already resolves minimatch 10.2.x, so this dedupes rather than adds).

npm audit: 0 vulnerabilities. 504 vitest tests, eslint, prettier and
vite build all pass; `npm ci` reinstalls the lock cleanly.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SKNkeeo4ggQFfNWcFNLFtE

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: berntpopp

.github/workflows/ci.yml

@@ -404,7 +404,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.12'
 

.github/workflows/docker.yml

@@ -88,7 +88,7 @@ jobs:
 
       - name: Build (no push)
         if: ${{ steps.gate.outputs.build == 'true' }}
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: ${{ matrix.context }}
           file: ${{ matrix.dockerfile }}
@@ -136,7 +136,7 @@ jobs:
 
       - name: Log in to GHCR
         if: ${{ steps.gate.outputs.build == 'true' }}
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -161,7 +161,7 @@ jobs:
 
       - name: Build and push
         if: ${{ steps.gate.outputs.build == 'true' }}
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: ${{ matrix.context }}
           file: ${{ matrix.dockerfile }}

backend/app/phenopackets/README.md

@@ -129,9 +129,7 @@ Computes molecular consequences from HGVS notations:
 from app.phenopackets.molecular_consequence import compute_molecular_consequence
 
 consequence = compute_molecular_consequence(
-    transcript="NM_000458.4:c.544+1G>T",
-    protein=None,
-    variant_type=None
+    transcript="NM_000458.4:c.544+1G>T", protein=None, variant_type=None
 )
 # Returns: "Splice Donor"
 ```
@@ -229,11 +227,11 @@ See [tests/README.md](../../tests/README.md) for detailed testing documentation.
         "phenotypicFeatures": [...],
         "interpretations": [...],
         "diseases": [...],
-        "metaData": {...}
+        "metaData": {...},
     },
     "created_at": "2025-10-27T12:00:00Z",
     "updated_at": "2025-10-27T12:00:00Z",
-    "schema_version": "2.0"
+    "schema_version": "2.0",
 }
 ```
 
@@ -253,7 +251,7 @@ See [tests/README.md](../../tests/README.md) for detailed testing documentation.
         "hg38": "chr17:36098063",
         "transcript": "NM_000458.4:c.1654-2A>T",
         "protein": "NP_000449.3:p.Ser552Ter",
-        "molecular_consequence": "Splice Acceptor"
+        "molecular_consequence": "Splice Acceptor",
     }
 ]
 ```

backend/pyproject.toml

@@ -41,8 +41,8 @@ dependencies = [
 
 [dependency-groups]
 dev = [
-    "ruff==0.15.20",
-    "mypy==2.1.0",
+    "ruff==0.16.0",
+    "mypy==2.3.0",
     "types-jsonschema>=4.25.1.20250822",
     "types-pyyaml>=6.0.12.20260408",  # Type stubs for PyYAML
     "types-redis>=4.6.0",  # Type stubs for Redis

backend/requirements-dev.txt

@@ -5,8 +5,8 @@
 -r requirements.txt
 
 # Development tools (from [dependency-groups.dev])
-ruff==0.15.20
-mypy==2.1.0
+ruff==0.16.0
+mypy==2.3.0
 
 # Testing (from [dependency-groups.test])
 pytest==9.1.1

backend/requirements.txt

@@ -2,7 +2,7 @@
 #    uv export --format requirements.txt --no-dev --no-hashes --no-emit-project --output-file requirements.txt
 aiohappyeyeballs==2.7.1
     # via aiohttp
-aiohttp==3.14.1
+aiohttp==3.14.3
     # via hnf1b-api
 aiosignal==1.4.0
     # via aiohttp
@@ -12,9 +12,9 @@ alembic==1.18.5
     # via hnf1b-api
 annotated-doc==0.0.4
     # via fastapi
-annotated-types==0.7.0
+annotated-types==0.8.0
     # via pydantic
-anyio==4.14.1
+anyio==4.14.2
     # via
     #   httpx
     #   starlette
@@ -42,16 +42,16 @@ bioutils==0.6.1
     # via ga4gh-vrs
 canonicaljson==2.0.0
     # via ga4gh-vrs
-certifi==2026.6.17
+certifi==2026.7.22
     # via
     #   httpcore
     #   httpx
     #   requests
-cffi==2.0.0
+cffi==2.1.0
     # via argon2-cffi-bindings
 chardet==5.2.0
     # via pronto
-charset-normalizer==3.4.7
+charset-normalizer==3.4.9
     # via requests
 click==8.4.2
     # via uvicorn
@@ -63,7 +63,7 @@ email-validator==2.3.0
     # via hnf1b-api
 exceptiongroup==1.3.1 ; python_full_version < '3.11'
     # via anyio
-fastapi==0.139.0
+fastapi==0.141.1
     # via hnf1b-api
 fastobo==0.14.1
     # via pronto
@@ -73,7 +73,7 @@ frozenlist==1.8.0
     #   aiosignal
 ga4gh-vrs==2.3.3
     # via hnf1b-api
-greenlet==3.5.3
+greenlet==3.5.4
     # via sqlalchemy
 h11==0.16.0
     # via
@@ -237,7 +237,9 @@ uvloop==0.22.1 ; platform_python_implementation != 'PyPy' and sys_platform != 'c
     # via uvicorn
 watchfiles==1.2.0
     # via uvicorn
-websockets==16.0
+websockets==16.1.1 ; python_full_version < '3.11'
     # via uvicorn
-yarl==1.24.2
+websockets==17.0 ; python_full_version >= '3.11'
+    # via uvicorn
+yarl==1.24.5
     # via aiohttp

backend/tests/README.md

@@ -253,6 +253,7 @@ def db_session():
     yield session
     # Teardown
 
+
 @pytest.fixture
 def sample_phenopacket():
     """Provide a sample phenopacket for tests."""