fix: upgrade vulnerable Python/WebUI dependencies (Snyk P0)

[vanessasalas-cog]

Make sure to read the contributing guidelines before submitting a PR

Dependency-hygiene only, from the Snyk audit of f72da88. No source or build changes.

Poetry lock moves (poetry.lock): certifi 2024.2.2 -> 2026.7.22, idna 3.6 -> 3.19, jinja2 3.1.3 -> 3.1.6, requests 2.31.0 -> 2.32.5, tqdm 4.66.2 -> 4.70.0, urllib3 2.2.1 -> 2.6.3, protobuf 4.25.3 -> 4.25.9, sentencepiece 0.1.99 -> 0.2.2. Manifest constraints changed only where the lock needed room: sentencepiece = ">=0.2.1,<0.3.0" in pyproject.toml, the same range in gguf-py/pyproject.toml (the optional extra there still capped at <=0.2.0, i.e. the vulnerable version stayed permitted in the package whose vocab.py actually imports it), and pillow~=12.3.0 in tools/mtmd/requirements.txt. WebUI is lockfile-only — mdast-util-to-hast 13.2.0 -> 13.2.1, package.json untouched.

Root Poetry project: 47 issues / 81 vulnerable paths -> 30 issues / 42 paths. WebUI: 1 issue / 4 paths -> clean.

Deliberately out of scope:

• transformers (4.38.1) and torch — the High deserialization findings have no fix below transformers 5.x and none at all for torch; mitigate operationally (trusted checkpoints, weights_only=True). These, plus transitive filelock, are the bulk of the residual root findings.
• requests stops at 2.32.5 and urllib3 at 2.6.3 because 2.33.0 / 2.7.0 require Python >= 3.10 and this project supports >=3.9. What remains is one Medium (insecure temp file, SNYK-PYTHON-REQUESTS-15763443) and SNYK-PYTHON-URLLIB3-16642024; dropping 3.9 support to close them is a separate decision.
• Pillow's post-upgrade state is unverified by Snyk: snyk test on tools/mtmd/requirements.txt resolves pillow to 12.1.1 regardless of the ~=12.3.0 cap, so the 15 Pillow findings still show. 12.3.0 is published on PyPI and is the Snyk-stated fixed version for them.
• The .github/workflows/snyk-security-scan.yml fixes (it installs paths from a different project, targets a different Snyk org, and runs SAST only — so it would have caught none of the above) are not in this PR.

Verified with per-manifest snyk test, poetry check, and pre-commit run --files on the changed files. Note for anyone running lint locally: pre-commit cannot install its own env on this repo — flake8-no-print pins flake8==4.0.1 against the configured 7.0.0, which is a preexisting config break unrelated to this change.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/f9f84d20063147bba263af257c1afaac
Requested by: @vanessasalas-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

💡 Connect your GitHub account to enable automatic code reviews.

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 0 new potential issues.

[devin-ai-integration]

CI note — the failures on this branch are not from these dependency changes, and none are fixable without going outside its scope:

• server-windows: .github/actions/windows-setup-curl/action.yml downloads https://curl.se/windows/dl-8.6.0_6/curl-8.6.0_6-win64-mingw.zip, which now 404s (8 KB HTML body, then tar.exe: Unrecognized archive format). Upstream artifact removal; needs a CURL_VERSION bump in that action.
• pyright type-check: reproduced the workflow (Python 3.11, pyright 1.1.382, requirements-all.txt) at base f72da888 and at this branch — the same 4 errors, byte-for-byte, in both ([REDACTED SECRET]s/json_schema_pydantic_[REDACTED SECRET].py:68,69, gguf-py/gguf/vocab.py:693,701). Only pip freeze difference between the two runs is pillow 11.3.0 -> 12.3.0.
• server-build (Release / ADDRESS / UNDEFINED): all three fail unit/test_ctx_shift.py::test_ctx_shift_disabled_short_prompt[-1-120-True] (assert 248 == 120). That job's Python env comes solely from tools/server/tests/requirements.txt, which this PR does not touch (git diff f72da888..HEAD -- tools/server/tests/ requirements/ is empty).
• security/snyk (Colhodm): You have used your limit of private tests — account quota. security/snyk (Cognition-default): reports 1 failed test; the residual findings on this branch are the deliberately deferred transformers/torch set plus transitive filelock, and protobuf/requests/urllib3 issues whose fixes need Python >= 3.10 (see description). I couldn't attribute the check to a specific Snyk project — the API returns 403 for that org from here.

check-requirements, WebUI Check, WebUI Build and Run WebUI tests pass.