Remediate dependency security alerts

backend/requirements-clinical.txt

@@ -1,11 +1,11 @@
 # Governed clinical dependency set for Linux bootstrap and the local clinical stack.
 # Keeps the clinical validation path separate from research/agent/audio extras.
-fastapi==0.103.2
+fastapi==0.141.1
 httpx==0.27.2
 itsdangerous==2.2.0
 pydantic==2.10.6
-pydicom==3.0.1
-pytest==8.3.4
-python-multipart==0.0.22
+pydicom==3.0.2
+pytest==9.0.3
+python-multipart==0.0.31
 SQLAlchemy==2.0.38
 uvicorn==0.23.2

backend/requirements.txt

@@ -3,14 +3,14 @@
 # `backend/requirements-clinical.txt`.
 aiofiles==23.2.1
 aiohappyeyeballs==2.5.0
-aiohttp==3.13.3
+aiohttp==3.14.3
 aioice==0.9.0
 aiortc==1.10.1
 aiosignal==1.4.0
 annotated-types==0.7.0
-anthropic==0.84.0
-anyio==3.7.1
-arxiv==2.1.3
+anthropic==0.96.0
+anyio==4.8.0
+arxiv==4.0.1
 asyncpg==0.29.0
 attrs==25.1.0
 audioread==3.0.1
@@ -26,41 +26,42 @@ cachetools==5.5.2
 certifi==2025.1.31
 chardet==5.2.0
 charset-normalizer==3.4.1
-click==8.1.8
+click==8.3.3
 colorama==0.4.6
 coloredlogs==15.0.1
 colorlog==6.9.0
 csvw==3.5.1
-curl_cffi==0.9.0
+curl_cffi==0.15.0
+cryptography==50.0.0
 dataclasses-json==0.6.7
 decorator==5.2.1
-# The current research runtime is aligned with the pre-Google-GenAI deepagents
-# line; newer releases force AnyIO 4.x through langchain-google-genai.
+# The research runtime now uses AnyIO 4.x because the Vertex AI SDK's
+# google-genai dependency requires it; keep this aligned with deepagents.
 deepagents==0.3.0
-deepdiff==8.6.1
+deepdiff==8.6.2
 dlinfo==2.0.0
 dnspython==2.7.0
 docstring_parser==0.16
 duckduckgo_search==4.5.0
 emoji==2.14.1
 espeakng-loader==0.2.4
 eventlet==0.40.3
-fastapi==0.103.2
+fastapi==0.141.1
 # fastrtc is not part of the shipped RadSysX runtime and currently forces an
 # incompatible numpy 2.x dependency chain.
 feedparser==6.0.11
 ffmpy==0.5.0
 filelock==3.20.3
 filetype==1.2.0
 fireworks-ai==0.11.2
-Flask==3.1.1
+Flask==3.1.3
 Flask-SocketIO==5.5.1
 flatbuffers==25.2.10
 frozenlist==1.5.0
 fsspec==2025.2.0
 google-api-core==2.24.1
 google-auth==2.49.0
-google-cloud-aiplatform==1.82.0
+google-cloud-aiplatform==1.133.0
 google-cloud-bigquery==3.30.0
 google-cloud-core==2.4.2
 google-cloud-resource-manager==1.14.1
@@ -74,11 +75,11 @@ greenlet==3.1.1
 grpc-google-iam-v1==0.14.0
 grpcio==1.71.0rc2
 grpcio-status==1.71.0rc2
-httpx==0.27.2
+httpx==0.28.1
 httpx-sse==0.4.0
 huggingface-hub==0.29.1
 humanfriendly==10.0
-idna==3.10
+idna==3.15
 ifaddr==0.2.0
 isodate==0.7.2
 itsdangerous==2.2.0
@@ -94,11 +95,13 @@ jsonschema-specifications==2024.10.1
 kay==0.1.2
 # Kokoro TTS tooling is not part of the shipped RadSysX runtime.
 langchain>=1.2.0
+langchain-anthropic==1.4.6
 langchain-community==0.4.1
 langchain-core>=1.2.0
 # These older provider/tooling add-ons are not imported by the shipped runtime
 # and routinely constrain the core LangChain stack.
-langchain-openai>=1.1.0
+langchain-openai>=1.1.14
+langsmith==0.8.18
 langdetect==1.0.9
 langgraph>=1.0.0
 langgraph-checkpoint>=4.0.0
@@ -110,16 +113,16 @@ language-tags==1.2.0
 lazy_loader==0.4
 librosa==0.10.2.post1
 llvmlite==0.44.0
-lxml==5.3.1
+lxml==6.1.0
 
 MarkupSafe==2.1.5
 marshmallow==3.26.2
 
 mpmath==1.3.0
-msgpack==1.1.0
+msgpack==1.2.1
 multidict==6.1.0
 mypy-extensions==1.0.0
-nltk==3.9.1
+nltk==3.10.0
 numba==0.61.0
 numpy==1.26.4
 onnxruntime==1.20.1
@@ -129,17 +132,17 @@ orderly-set==5.4.1
 orjson==3.11.7
 packaging==26.0
 pandas==2.2.3
-pdfminer.six==20231228
+pdfminer.six==20251230
 pgvector==0.2.5
 phonemizer-fork==3.3.1
-pillow==11.1.0
+pillow==12.3.0
 
 pooch==1.8.2
 propcache==0.3.0
 proto-plus==1.26.0
 protobuf==5.29.6
 psycopg2-binary==2.9.10
-pyasn1==0.6.2
+pyasn1==0.6.4
 pyasn1_modules==0.4.1
 
 
@@ -149,26 +152,26 @@ pydub==0.25.1
 pyee==12.1.1
 
 pylibsrtp==0.11.0
-pyOpenSSL==25.0.0
+pyOpenSSL==26.4.0
 pyparsing==3.2.1
-pydicom==3.0.1
-pypdf==6.6.2
+pydicom==3.0.2
+pypdf==6.15.0
 
 python-dateutil==2.9.0.post0
 python-docx==1.1.2
-python-dotenv==1.0.1
-python-engineio==4.11.2
+python-dotenv==1.2.2
+python-engineio==4.13.2
 python-iso639==2025.2.18
 python-magic==0.4.27
-python-multipart==0.0.22
-python-socketio==5.14.0
+python-multipart==0.0.31
+python-socketio==5.16.2
 pytz==2025.1
 PyYAML==6.0.2
 RapidFuzz==3.12.1
 rdflib==7.1.3
 referencing==0.36.2
 regex==2024.11.6
-requests==2.32.5
+requests==2.33.0
 requests-toolbelt==1.0.0
 rfc3986==1.5.0
 rpds-py==0.23.1
@@ -180,7 +183,7 @@ scikit-learn==1.6.1
 scipy==1.15.2
 segments==2.3.0
 semantic-version==2.10.0
-setuptools==78.1.1
+setuptools==83.0.0
 sgmllib3k==1.0.0
 shapely==2.0.7
 shellingham==1.5.4
@@ -189,11 +192,11 @@ six==1.17.0
 sniffio==1.3.1
 socksio==1.0.0
 soundfile==0.13.1
-soupsieve==2.6
+soupsieve==2.8.4
 soxr==0.5.0.post1
 SQLAlchemy==2.0.38
 sse-starlette==1.8.2
-starlette==0.27.0
+starlette==1.6.0
 sympy==1.13.3
 tabulate==0.9.0
 tenacity==8.5.0
@@ -206,20 +209,20 @@ typer==0.15.2
 types-protobuf==4.25.0.20240417
 types-requests==2.32.0.20250301
 typing-inspect==0.9.0
-typing_extensions==4.12.2
+typing_extensions==4.14.0
 tzdata==2025.1
 unstructured==0.18.18
 unstructured-client==0.22.0
 uritemplate==4.1.1
-urllib3==2.6.3
+urllib3==2.7.0
 uvicorn==0.23.2
 webrtcvad==2.0.10
-websockets==14.2
-Werkzeug==3.1.5
+websockets==15.0.1
+Werkzeug==3.1.6
 wheel==0.46.2
 wikipedia==1.4.0
 wrapt==1.17.2
 wsproto==1.2.0
 xmltodict==0.13.0
 yarl==1.18.3
-pytest==8.3.4
+pytest==9.0.3

desktop/package.json

@@ -24,6 +24,6 @@
     "smoke": "node ./scripts/startup-smoke.mjs"
   },
   "devDependencies": {
-    "electron": "^39.2.6"
+    "electron": "^43.0.0"
   }
 }

frontend/next.config.js

@@ -40,7 +40,10 @@ const nextConfig = {
       // Client-side polyfills for Cornerstone3D and DICOM dependencies
       buffer: 'buffer',
       'process/browser': 'process/browser',
-      util: 'util',
+      util: {
+        browser: 'util',
+        node: 'node:util',
+      },
     },
   },
 

frontend/package.json

@@ -19,7 +19,6 @@
     "format:check": "prettier --check ."
   },
   "dependencies": {
-    "@radsysx/clinical-web": "file:../packages/clinical-web",
     "@cornerstonejs/core": "^3.19.3",
     "@cornerstonejs/dicom-image-loader": "^3.19.3",
     "@cornerstonejs/tools": "^3.19.3",
@@ -30,18 +29,19 @@
     "@radix-ui/react-slider": "^1.1.2",
     "@radix-ui/react-tabs": "^1.0.4",
     "@radix-ui/react-toast": "^1.2.5",
+    "@radsysx/clinical-web": "file:../packages/clinical-web",
     "@tailwindcss/forms": "^0.5.10",
     "@tailwindcss/typography": "^0.5.19",
     "@tanstack/react-query": "^5.0.0",
-    "axios": "^1.9.0",
+    "axios": "^1.18.0",
     "class-variance-authority": "^0.7.0",
     "clsx": "^2.0.0",
     "dicom-parser": "1.8.21",
     "dicomweb-client": "0.10.4",
     "framer-motion": "^10.16.4",
     "hammerjs": "^2.0.8",
     "lucide-react": "^0.294.0",
-    "next": "^16.1.6",
+    "next": "16.3.1",
     "react": "^18",
     "react-dom": "^18",
     "react-draggable": "^4.4.6",
@@ -72,7 +72,7 @@
     "next-transpile-modules": "^10.0.1",
     "null-loader": "^4.0.1",
     "path-browserify": "^1.0.1",
-    "postcss": "^8.4.31",
+    "postcss": "^8.5.23",
     "prisma": "^6.2.1",
     "process": "^0.11.10",
     "querystring-es3": "^0.2.1",