chore(deps): consolidate PRs #128-137, fix h2/lru advisories

[pacphi]

Consolidates 8 of the 11 open Dependabot PRs into a single branch, applied as latest-compatible-within-major, plus a security-driven fix for two advisories found during the audit pass.

Superseded PRs

PR	Package	Bump	Area
#128	serde_json	1.0.150 → 1.0.151	Rust
#130	js-yaml	5.2.2 → 5.2.3	TS (frontend)
#131	calamine	0.36.0 → 0.36.1	Rust
#132	http-body-util	0.1.4 → 0.1.5	Rust
#133	vite	8.0.16 → 8.2.1	TS (frontend)
#134	prettier	3.8.3 → 3.9.6	TS (frontend)
#135	recharts	3.8.1 → 3.10.1	TS (frontend)
#137	taiki-e/install-action	2.85.8 → 2.86.3	GitHub Actions

Deferred (left open)

• deps(rust): bump candle-core from 0.10.2 to 0.11.0 #116 / deps(rust): bump candle-transformers from 0.10.2 to 0.11.0 #126 (candle-core / candle-transformers 0.10.2 → 0.11.0): still blocked. mistralrs (pinned at 0.8.1) has not shipped a release supporting candle 0.11; bumping alone would create duplicate candle-core/candle-nn builds in the workspace, which the existing Cargo.toml comment explicitly says the 0.10 pin exists to avoid. Same blocker as the last consolidation (chore(deps): consolidate PRs #116-126, fix rkyv/brace-expansion/nanoid advisories #127).
• deps(ts): bump @tanstack/react-table from 8.21.3 to 9.1.2 in /frontend #136 (@tanstack/react-table 8.21.3 → 9.1.2): 8.21.3 is still the latest published 8.x release, so this is a major-version rewrite, not a patch/minor bump — same situation as the previously-deferred deps(ts): bump @tanstack/react-table from 8.21.3 to 9.0.0 in /frontend #119.

Pre-existing / upgrade-caused fixes

• Prettier 3.9 changed union-type-alias wrapping ("don't break union type when it can fit"), which flipped two already-passing files to fail the prettier --check gate under the new formatter version. Reformatted with prettier --write (RecurringPage.tsx, models.ts) — no logic changes, formatting only.

Security audit

Ran cargo audit (via the CI's exact .github/scripts/cargo-audit.sh gate), pnpm audit, and checked GitHub Dependabot alerts.

• RUSTSEC-2026-0258 (h2 0.4.14, unbounded empty DATA frames — DoS): fixed. Bumped h2 to 0.4.16 via an in-range, lockfile-only update (transitive through aws-smithy-http-client/hyper).
• RUSTSEC-2026-0253 (lru 0.16.4, use-after-free risk in LruCache::pop() under panic): deferred, documented. aws-sdk-s3 (checked up to its latest 1.143.0 release) hard-pins lru = "^0.16.3"; the fix landed in lru 0.18.0, a semver-major bump upstream hasn't adopted yet. No safe override exists without breaking aws-sdk-s3's own dependency graph. Added to audit-ignore and .cargo/audit.toml with rationale; will resolve once aws-sdk-s3 bumps its lru requirement.
• RUSTSEC-2026-0235 (rkyv 0.7.46, pre-existing ignore): also added to .cargo/audit.toml, which was missing this entry despite audit-ignore already covering it (the header comment says the two files should mirror each other) — brings them back in sync. No behavior change.
• pnpm audit: no known vulnerabilities.
• GitHub Dependabot alerts: 0 open.

Verification

Mirrors the CI gates in .github/workflows/ci.yml exactly.

Frontend:

pnpm install --frozen-lockfile   # pass
pnpm run lint                    # pass
pnpm exec tsc --noEmit           # pass
pnpm exec prettier --check 'src/**/*.{ts,tsx,css}'  # pass
pnpm run test -- --run           # pass (9/9 tests)
pnpm run build                   # pass

Backend:

cargo fmt --all -- --check                                    # pass
cargo clippy --workspace --all-targets -- -D warnings         # pass
cargo test --workspace   # pass (incl. DB integration tests via docker-compose.test.yml)

Security:

bash .github/scripts/cargo-audit.sh   # pass, 9 documented exceptions

🤖 Generated with Claude Code

[pacphi]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.