Security: 7 CVE fixes for NSPECT-S62Q-PZUD

[nv-rag-cve-bot]

Summary

• Python CVEs (5 packages): pyarrow 21.0→25.0 (CVE-2026-25087), aiohttp 3.13.5→3.14.1 (CVE-2026-50269), langgraph-sdk 0.3.3→0.4.2 (CVE-2026-48776), pillow 12.2.0→12.3.0 (CVE-2026-59198/99/203/04/05), langchain-core override ≥1.3.3 (CVE-2025-65106/68664/2026-44843 — already installed 1.4.0, override makes constraint self-enforcing)
• Frontend CVEs (2 packages): vitest 3.2.4→3.2.7 (CVE-2026-53633 + GHSA-5xrq-8626-4rwp), react-router-dom 7.12→7.18.1 (GHSA-8x6r-g9mw-2r78 + related)
• Source: NSPECT-S62Q-PZUD (collection: NSPECT-UV6I-R3V9 container surface + NSPECT-O8B9-SHZ8 helm surface)

Changes

File	Change
pyproject.toml	pyarrow constraint bump; 5 override-dependencies updated/added
uv.lock	Regenerated (pyarrow 25.0, aiohttp 3.14.1, langgraph-sdk 0.4.2, pillow 12.3.0)
frontend/package.json	vitest → 3.2.7, react-router-dom → ^7.15.0
frontend/pnpm-lock.yaml	Regenerated
tests/unit/test_security_dependency_pins.py	Updated pillow threshold; added aiohttp/langgraph-sdk/pyarrow tests

Validation

Check	Status
Local §5a re-scan (10/10 security pin tests)	✅ PASSED
unit-tests	⏳ pending (Phase 9 CI)
frontend-unit-tests	⏳ pending (Phase 9 CI)
static-analysis	⏳ pending (Phase 9 CI)
docker-tests chain (--ci-wait-gpu)	⏳ pending (Phase 9 CI)

API Compatibility

• pyarrow 21→25: only pa.schema, pa.field, pa.array, pa.table used — all stable APIs (R2 PASS)
• react-router-dom 7.12→7.18: only BrowserRouter, Routes, Route, useNavigate, useLocation — unchanged across 7.x (R2 PASS)
• aiohttp / langgraph-sdk / pillow: transitive dependencies, no direct usage in application code

Local audit trail

cve-fix-reports/NSPECT-S62Q-PZUD-20260718-000000/ (not committed — local only)

---

Refs: NSPECT-S62Q-PZUD NSPECT-UV6I-R3V9 NSPECT-O8B9-SHZ8
Generated-by: agentic-cve-fix

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[nv-rag-cve-bot]

CI Note: The Unit Tests failure is a pre-existing regression unrelated to this security fix.

• Failing test: tests/unit/test_utils/test_vdb/test_elastic_vdb.py::TestElasticVDB::test_write_to_index
• Error: AttributeError: module 'nv_ingest_client.util' has no attribute 'milvus'
• Same failure confirmed on main branch (run 29609141133) before this PR was opened.

This PR only modifies: pyproject.toml, uv.lock, frontend/package.json, frontend/pnpm-lock.yaml, frontend/package-lock.json, tests/unit/test_security_dependency_pins.py. The elastic VDB test does not touch any of these files.

Frontend Unit Tests ✅, lint ✅ (non-GPU fast chain): all green.
Integration Tests: still running (~45 min GPU chain, gated by --ci-wait-gpu).

Generated-by: agentic-cve-fix