fix(security): bump vulnerable example deps (supersedes #155)

[andriy-sudo]

Summary

Supersedes Dependabot #155 (axios 1.15.0 → 1.18.1, examples/js only). That PR bumped axios but left form-data 4.0.5 still vulnerable (GHSA-hmw2-7cc7-3qxx, HIGH) and did not touch the newly-published dev-tree advisories or the Python example. This PR clears every open finding across both example ecosystems and removes a now-stale suppression.

All changes are limited to manifest/lock file version bumps — no functional source code changes.

examples/js — package.json overrides + package-lock.json

Package	Old	New	Advisory	Severity	Status
axios	1.15.0	1.18.1	GHSA-j5f8-grm9-p9fc (+8 more)	HIGH	✅ Fixed
form-data	4.0.5	4.0.6	GHSA-hmw2-7cc7-3qxx (CRLF injection)	HIGH	✅ Fixed
ajv (dev)	6.12.6	6.14.0	GHSA-2g4f-4pwh-qvx6 (ReDoS)	MEDIUM	✅ Fixed
brace-expansion (dev)	1.1.12	1.1.13	GHSA-f886-m6hf-6m8v (DoS)	MEDIUM	✅ Fixed
js-yaml (dev)	4.1.1	4.2.0	GHSA-h67p-54hq-rp68 (quadratic DoS)	MEDIUM	✅ Fixed

examples/python — pyproject.toml floor pins + poetry.lock

Package	Old	New	Advisory	Severity	Status
urllib3	2.6.3	2.7.0	PYSEC-2026-141, PYSEC-2026-142	HIGH	✅ Fixed
idna	3.11	3.18	PYSEC-2026-215 (GHSA-65pc-fj4g-8rjx)	MEDIUM	✅ Fixed
pygments	2.19.2	2.20.0	GHSA-5239-wwwm-4pmq (ReDoS)	LOW	✅ Fixed

osv-scanner.toml

Removed the GHSA-5239-wwwm-4pmq ignore — it was both expired (ignoreUntil = 2026-06-23) and stale: a fix is now published in pygments 2.20.0, so the lock is upgraded instead of suppressed.

Verification

osv-scanner scan --config osv-scanner.toml --recursive ./ → No issues found (both lock files, no unused ignores). npm audit in examples/js → 0 vulnerabilities.

Reviewer: please close Dependabot #155 as superseded by this PR after merge.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 501e557b-64de-4863-a169-088592b520b5

📥 Commits

Reviewing files that changed from the base of the PR and between 7f5527b and be89dd3.

⛔ Files ignored due to path filters (2)

• examples/js/package-lock.json is excluded by !**/package-lock.json
• examples/python/poetry.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• examples/js/package.json
• examples/python/pyproject.toml
• osv-scanner.toml

---

📝 Walkthrough

Walkthrough

The PR updates dependency constraints in the example JavaScript and Python projects. It expands the JavaScript package overrides, raises the axios override version, adds minimum version pins for urllib3, idna, and pygments in the Python example, and removes the active pygments vulnerability ignore from osv-scanner.toml.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the security-focused dependency bump across the example projects.
Description check	✅ Passed	The description accurately matches the manifest and lockfile security fixes described in the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch andriy/fix-examples-deps-vulns

---

_{Comment @coderabbitai help to get the list of available commands.}