fix(security): resolve Dependabot alerts #21–25

[ichwars]

Summary

Closes #177.

• Upgrade Vitest, its mocker, and coverage packages from 4.1.8 to 4.1.11 (CVE-2026-84373; alerts #21/#22).
• Pin WeasyPrint 70.0 in requirements.txt and both hash lockfiles (CVE-2026-55073; alerts #23/#24/#25).
• Ship the SHA-256-verified Windows onedir runtime with all native DLLs at the existing CLI path; update current renderer receipts/cache identity/PDF producer metadata, preserving immutable historical artifacts.
• Add reproducible resource-policy regression tests, Windows packaging checks, and durable triage documentation. The mocker security check runs in required frontend CI. No new audit exceptions or alert dismissals.

Verification

• 3,078 frontend tests across 273 files; i18n parity; 3 real mocker-policy checks; ESLint; TypeScript/production build including Safari-16 syntax gate.
• Full native Windows PDF/A matrix: all 156 document-type/language/page-format/template cases passed with verified veraPDF 1.30.2.
• 56 remaining PDF, hybrid e-invoice, deterministic rendering, archived-receipt and security checks plus 2 portable installer-packaging checks passed after updating the two ten-page stress fixtures for v70 pagination; page minima and time budgets unchanged. Packaging checks run explicitly in required CI outside the backend-only Docker image.
• Independent text extraction of 80- and 90-position PDFs confirmed every position is retained (9 and 10 pages respectively).
• Regression witnesses: old Vitest reads both denied/out-of-root canaries; 4.1.11 blocks them and retains allowed mocks. WeasyPrint 69.0 bypasses the original fetcher for stylesheet/import/XMP; all 5 policy/control tests pass on 70.0.
• Ruff lint and formatting, 1,791-file source budget, dependency boundaries, import-shadowing tests, pip check, npm audit (0 vulnerabilities), pip-audit (existing repository exception policy only).

Scope / integration notes

Implementation and review were entirely inline, without sub-agents. Existing user changes under static/ are not included or overwritten; local frontend output went to an isolated temporary directory. Local Docker daemon is unavailable; all hosted Docker CI jobs passed. Native Java/PDF tests ran outside the restrictive tool sandbox using isolated test directories; production security/time limits were not relaxed.

All 31 GitHub checks passed for e23b735: CI, CodeQL, and Security Audit. Hosted tests: 8,716 backend tests, 8,700 Docker backend tests, and 2,955 production-container integration tests passed; the 3,078 frontend tests and 3 mocker security checks passed under Node 22. Post-merge verification completed: Dependabot shows 0 Open / 23 Closed; alerts #21–#25 are individually Fixed (not dismissed). Local main and origin/main are synchronized at 1b66704, whose Git tree exactly matches the tested PR head. See docs/security-alert-triage-2026-09-11.md for details.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-11T13:07:30.150954Z	f86d010	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ichwars]

CI-Rückmeldung umgesetzt: Der neue portable Windows-Packaging-Test importiert Installer-Quellen, die absichtlich nicht im Backend-Testimage enthalten sind. Er liegt jetzt unter installers/windows/tests/ und wird im verpflichtenden Backend-Lint-Job ausdrücklich ausgeführt und gelintet/formatiert. Keine Tests werden übersprungen und dem Produktimage werden keine Build-Werkzeuge hinzugefügt. Lokal: beide verschobenen Tests, Ruff und Größenprüfung bestanden. Die übrigen 156 nativen PDF/A-Matrixfälle und 56 Backend-PDF-/Sicherheitsregressionen bleiben unverändert; der neue Head durchläuft erneut sämtliche CI-Gates.