fix(deps): patch Dependabot security alerts

- Pillow 11.1.0 -> 12.2.0 (6 CVEs: OOB writes, decompression bomb, DoS)
- rembg 2.0.62 -> 2.0.75 (SSRF + path traversal in server component)
- @fastify/static ^8.1.0 -> ^9.1.3 (path traversal + route guard bypass)
- Remove redundant @fastify/static pnpm override
- Dismiss stale esbuild alert (already at 0.28.0)
- Dismiss file-type alert (16.5.4 is dev-only via @types/potrace)

apps/api/package.json

@@ -17,7 +17,7 @@
     "@fastify/cors": "^11.0.0",
     "@fastify/multipart": "^9.0.0",
     "@fastify/rate-limit": "^10.2.0",
-    "@fastify/static": "^8.1.0",
+    "@fastify/static": "^9.1.3",
     "@neplex/vectorizer": "^0.1.0",
     "@scalar/fastify-api-reference": "^1.57.5",
     "@sentry/node": "^10.55.0",

docker/feature-manifest.json

@@ -2,14 +2,14 @@
   "manifestVersion": 1,
   "imageVersion": "2.0.0",
   "pythonVersion": "3.12",
-  "basePackages": ["numpy==1.26.4", "Pillow==11.1.0", "opencv-python-headless==4.10.0.84"],
+  "basePackages": ["numpy==1.26.4", "Pillow==12.2.0", "opencv-python-headless==4.10.0.84"],
   "bundles": {
     "background-removal": {
       "name": "Background Removal",
       "description": "Remove image backgrounds with AI",
       "estimatedSize": "4-5 GB",
       "packages": {
-        "common": ["rembg==2.0.62"],
+        "common": ["rembg==2.0.75"],
         "amd64": ["onnxruntime-gpu==1.20.1", "mediapipe>=0.10.21"],
         "arm64": ["onnxruntime==1.20.1", "mediapipe>=0.10.18"]
       },

package.json

@@ -93,8 +93,7 @@
       "protobufjs": ">=7.5.6",
       "@protobufjs/utf8": ">=1.1.1",
       "postcss": ">=8.5.10",
-      "vite": ">=6.4.2",
-      "@fastify/static": ">=9.1.3"
+      "vite": ">=6.4.2"
     }
   },
   "dependencies": {

packages/ai/python/requirements-gpu.txt

@@ -1,10 +1,10 @@
-rembg==2.0.62
+rembg==2.0.75
 realesrgan==0.3.0
 paddleocr==2.9.1
 paddlepaddle-gpu==3.0.0
 mediapipe>=0.10.21
 onnxruntime-gpu==1.20.1
 numpy==1.26.4
-Pillow==11.1.0
+Pillow==12.2.0
 opencv-python-headless==4.10.0.84
 codeformer-pip==0.0.4

packages/ai/python/requirements.txt

@@ -1,10 +1,10 @@
-rembg[cpu]==2.0.62
+rembg[cpu]==2.0.75
 realesrgan==0.3.0
 paddleocr[doc-parser]>=3.4.0,<3.5.0
 paddlepaddle>=3.0.0,<3.1.0
 mediapipe>=0.10.21
 onnxruntime==1.20.1
 numpy==1.26.4
-Pillow==11.1.0
+Pillow==12.2.0
 opencv-python-headless==4.10.0.84
 codeformer-pip==0.0.4

pnpm-lock.yaml

@@ -20,7 +20,6 @@ overrides:
   '@protobufjs/utf8': '>=1.1.1'
   postcss: '>=8.5.10'
   vite: '>=6.4.2'
-  '@fastify/static': '>=9.1.3'
 
 importers:
 
@@ -121,7 +120,7 @@ importers:
         specifier: ^10.2.0
         version: 10.3.0
       '@fastify/static':
-        specifier: '>=9.1.3'
+        specifier: ^9.1.3
         version: 9.1.3
       '@neplex/vectorizer':
         specifier: ^0.1.0