fix(deps): clear Dependabot advisories across example stacks

[mikeland73]

Summary

Dependabot had 118 open alerts (4 critical, 23 high), almost all of them in the example stacks' lock files. Rather than take the alerts one at a time, each affected manifest was re-resolved with its own package manager and then audited package-by-package against the OSV database. Every ecosystem below now comes back with zero advisories.

Stack	Change	Alerts cleared
examples/stacks/drupal	drupal/core 10.5.6 → 10.6.16, twig/twig 3.28.0, guzzlehttp/guzzle 7.15.5	36
examples/stacks/rails	rails 7.2.3.2, puma 7.2.1, sqlite3 2.9.6, rack 3.2.7, rack-session 2.1.2, erb 6.0.7, concurrent-ruby 1.3.8, websocket-driver 0.8.2, nokogiri 1.19.4	25
examples/stacks/django	Django 4.2.29 → 5.2.17, sqlparse 0.5.4 → 0.6.0, asgiref, psycopg2	9 Django + 5 sqlparse
testscripts/shellenv/node	less 4.4.2 → 4.9.1, less-watch-compiler pinned to 1.19.4	4

Note on Go: this branch originally also bumped klauspost/compress (v1.18.1 → v1.18.7) with a regenerated vendor-hash. #2977 has since landed on main fixing the same advisory (GHSA-259r-337f-4rfw) and going further — v1.20.0 — alongside go.jetify.com/pkg, renameio and oauth2. That supersedes the bump here, so on merging main in, go.mod, go.sum and vendor-hash were resolved to main's side and are now byte-identical to it. This PR no longer touches Go at all.

Notes on the less-obvious bumps

Django needed a major-version move, not a patch. 4.2.30 would have cleared the two HIGH alerts (ASGI header spoofing, DATA_UPLOAD_MAX_MEMORY_SIZE bypass), but the 4.2 series is end-of-life and seven further advisories against it are only ever patched on 5.2/6.0. Moving to the current LTS clears all nine. USE_L10N was dropped from settings.py because Django 5.0 removed the setting.

Two Rails fixes were unreachable behind Gemfile constraints, so those two constraints were widened — every other gem moved on its own via bundle lock --update:

• puma "~> 6.0" → "~> 7.2". The PROXY protocol v1 memory-exhaustion and repeated-header advisories are only fixed in 7.2.1; there is no 6.x patch.
• sqlite3 "~> 1.4" → "~> 2.9". The use-after-free is only fixed in 2.9.5. Active Record 7.2 declares gem "sqlite3", ">= 1.4" (verified in the 7.2.3.2 gem), so the 2.x line is supported.

Every gem pulled in requires Ruby ≤ 3.2, well under the Gemfile's declared 4.0.6. Note BUNDLED WITH also moved 2.6.9 → 4.0.9, written by the bundler that did the resolve — incidental to the security fixes, and worth a glance.

Drupal needed no manifest edit. 10.6.16 and twig 3.28.0 both fall inside the existing ^10.3.14 constraint, so only composer.lock changed. Reaching 10.6.13+ matters: the DRUPAL-CORE-2026-010/-012 advisories have no fix on the 10.5 branch.

The node fixture needs both a move forward and a ceiling. less 4.9.1 is what drops the optional dependencies carrying the image-size and picomatch advisories. But this fixture pins nodejs@18, and less-watch-compiler 1.19.6+ requires Node ≥ 22.12 and depends on the ESM-only commander@15 — which throws ERR_REQUIRE_ESM under Node 18. 1.19.4 is the newest release still declaring node >=18, and it drops the vulnerable picomatch chain just as 1.19.9 does. npm has no way to express "newest version satisfying engines" in a range, so it is pinned exactly rather than left to float back onto a release this fixture's Node cannot load.

How was it tested?

CI was green on 12a69ed (28/28 checks) before the merge from main; it is re-running on the merge commit. Each ecosystem was also re-audited against OSV after the update — all clean:

• Drupal — composer validate passes and all 81 locked packages audit clean. The test runner skips Drupal, so it was verified separately: re-resolving with config.platform.php = 8.1.0 (the version the example pins) reports "Nothing to modify in lock file", confirming this lock is exactly the PHP 8.1 solution and not an artifact of a newer local PHP.
• Rails — bundle lock --update resolves successfully; all 90 gems in the resulting Gemfile.lock audit clean. Covered by the project-tests-only shards, which pass.
• Django — installed the new requirements.txt in a clean venv; manage.py check reports no issues, makemigrations --check detects no changes (so the existing migration is still valid under 5.2), migrate applies cleanly, and manage.py test runs green. Note the example has no run_test script, so CI does not exercise it.
• Node fixture — verified against Node 18.20.8 with npm 10.8.2, matching CI rather than the newer local toolchain: npm ci installs with no EBADENGINE warnings, npm run run_test exits 0, and less-out/style.css is byte-identical.
• Merge resolution — after taking main's Go files: go mod tidy is a no-op, go build ./... passes, and main's vendor-hash reproduces exactly from the merged vendor tree (checked with a NAR serializer equivalent to nix hash path).

Not verified: psycopg2 could not be compiled in this container (no pg_config/libpq headers), so the Django example's Postgres connection was exercised against SQLite instead. The version chosen is the current 2.9.x release and the pin's shape is unchanged.

Community Contribution License

All community contributions in this pull request are licensed to the project
maintainers under the terms of the
Apache 2 License.

By creating this pull request, I represent that I have the right to license the
contributions to the project maintainers under the Apache 2 License as stated in
the
Community Contribution License.

🤖 Generated with Claude Code

https://claude.ai/code/session_01183ZJp5f4BGGQTKGvJNSbC

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.