chore: batch dependency updates and analyze workflows with CodeQL

.github/workflows/ci.yml

@@ -538,8 +538,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Workflow YAML is covered by actionlint + zizmor in the pre-commit hooks.
-        language: [python, javascript-typescript]
+        # `actions` complements actionlint + zizmor with dataflow-based workflow queries.
+        language: [actions, python, javascript-typescript]
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

app/package.json

@@ -98,13 +98,13 @@
     "@testing-library/react-native": "13.3.3",
     "@types/jest": "29.5.14",
     "@types/react": "~19.2.18",
-    "@typescript-eslint/parser": "8.66.0",
+    "@typescript-eslint/parser": "8.68.0",
     "babel-plugin-react-compiler": "1.0.0",
-    "baseline-browser-mapping": "2.11.13",
-    "eslint": "10.8.1",
+    "baseline-browser-mapping": "2.11.20",
+    "eslint": "10.9.1",
     "eslint-plugin-react-hooks": "7.1.1",
     "eslint-plugin-react-native-a11y": "3.5.1",
-    "eslint-plugin-react-refresh": "0.5.3",
+    "eslint-plugin-react-refresh": "0.5.5",
     "jest": "29.7.0",
     "jest-expo": "~57.0.4",
     "jest-junit": "17.0.0",

backend/Dockerfile

@@ -7,7 +7,7 @@
 ARG WORKDIR=/opt/relab/backend
 
 # --- Build stage (prod deps only) ---
-FROM ghcr.io/astral-sh/uv:0.11-python3.14-trixie-slim@sha256:2e5867a06156cb8be272125d32fc5032ed750a1268a9350d87a7d322540eb59f AS build
+FROM ghcr.io/astral-sh/uv:0.12-python3.14-trixie-slim@sha256:d5ddd498c5a28ec77ff1c70276f8f3c4a116a303c8b5583a018ea43c2e89e366 AS build
 
 ARG WORKDIR
 WORKDIR $WORKDIR
@@ -27,7 +27,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     uv sync --locked --no-editable --no-default-groups
 
 # --- Dev stage (all groups, hot reload) ---
-FROM ghcr.io/astral-sh/uv:0.11-python3.14-trixie-slim@sha256:2e5867a06156cb8be272125d32fc5032ed750a1268a9350d87a7d322540eb59f AS dev
+FROM ghcr.io/astral-sh/uv:0.12-python3.14-trixie-slim@sha256:d5ddd498c5a28ec77ff1c70276f8f3c4a116a303c8b5583a018ea43c2e89e366 AS dev
 
 ARG WORKDIR
 WORKDIR $WORKDIR
@@ -56,7 +56,7 @@ EXPOSE 8000
 CMD [".venv/bin/uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--reload", "--reload-dir", "app"]
 
 # --- Runtime stage (default) ---
-FROM python:3.14-slim-trixie@sha256:656d12e70054d5fda18a045e2494c96701e9792dd1445f95b3d038df954f57e9 AS runtime
+FROM python:3.14-slim-trixie@sha256:cad9a2c871761c413caa6fdd6441c783451e740a48aaeba60ae62a8b53525ef6 AS runtime
 
 ARG WORKDIR
 ARG APP_USER=appuser

backend/Dockerfile.migrations

@@ -3,7 +3,7 @@
 # Production Dockerfile for Backend Migrations
 
 # --- Build stage ---
-FROM ghcr.io/astral-sh/uv:0.11-python3.14-trixie-slim@sha256:2e5867a06156cb8be272125d32fc5032ed750a1268a9350d87a7d322540eb59f AS build
+FROM ghcr.io/astral-sh/uv:0.12-python3.14-trixie-slim@sha256:d5ddd498c5a28ec77ff1c70276f8f3c4a116a303c8b5583a018ea43c2e89e366 AS build
 WORKDIR /opt/relab/backend-migrations
 
 # Create needed directories data uploads for seeding example images and files
@@ -35,7 +35,7 @@ COPY app/ app/
 COPY data/seed/ data/seed/
 
 # --- Runtime stage ---
-FROM python:3.14-slim-trixie@sha256:656d12e70054d5fda18a045e2494c96701e9792dd1445f95b3d038df954f57e9
+FROM python:3.14-slim-trixie@sha256:cad9a2c871761c413caa6fdd6441c783451e740a48aaeba60ae62a8b53525ef6
 
 ARG WORKDIR=/opt/relab/backend-migrations
 ARG APP_USER=appuser

compose.deploy.yaml

@@ -163,7 +163,7 @@ services:
     # MALWARE_SCAN_ENABLED=false, and treat that as an accepted risk.
     profiles:
       - scanning
-    image: clamav/clamav:1.5.3_base-debian@sha256:cb5b15312564be66d20d341390d8ec8ddcbfdfcd410a9c26ece8b5e8df6200c0
+    image: clamav/clamav:1.5.4_base-debian@sha256:2bc2f9c5c1fd5120a334490d005c694430f0589d085a7aca400bbd93458fe1f0
     logging: *json-logging
     entrypoint: /init-unprivileged
     user: clamav
@@ -303,7 +303,7 @@ services:
 
   cloudflared:
     # Cloudflared tunnel service
-    image: cloudflare/cloudflared:2026.8.2@sha256:0aa26e284f05e6c77ae375b8c9c11d9eb6a448fb7bcd8d40f31cb6176189eb38
+    image: cloudflare/cloudflared:2026.8.3@sha256:51c9cefcb4569df44e1ad403ab1d3d8065aa8e84339bcfc6aee75502e1140339
     logging: *json-logging
     restart: unless-stopped
     depends_on:

compose.telemetry.gpu.yml

@@ -16,7 +16,7 @@
 
 services:
   nvidia-gpu-exporter:
-    image: utkuozdemir/nvidia_gpu_exporter:1.14.0-nvml@sha256:82acc3fc60a5a709846ea9757bbccb170fd141039fa47e5899c55fe9a60f56fe
+    image: utkuozdemir/nvidia_gpu_exporter:1.15.1-nvml@sha256:92a73ec03e2f5cae4a7cfcc99c242b46797741c24de8f3768d394925f8e0a323
     restart: unless-stopped
     # The NVML backend reports XID error counters; the nvidia-smi backend cannot.
     environment:

docs/package.json

@@ -40,6 +40,6 @@
     "linkinator": "7.6.1",
     "playwright": "catalog:",
     "typescript": "catalog:",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   }
 }