Fix Dependabot security alerts (12 vulnerabilities)

[mishushakov]

Summary

Resolves all 12 open Dependabot alerts by bumping vulnerable dev/transitive dependencies across the npm and Python projects.

• npm (pnpm-lock.yaml): postcss → 8.5.12, vite → 7.3.2, brace-expansion → 5.0.5, smol-toml → 1.6.1
• python/: pytest ^9.0.3, pytest-asyncio ^1.3.0 (required for pytest 9), pillow → 12.2.0, pygments → 2.20.0, python-dotenv → 1.2.2
• chart_data_extractor/: pytest ^9.0.3, pillow → 12.2.0, pygments → 2.20.0
• template/requirements.txt: pytest 9.0.3

All updates affect dev or transitive-dev dependencies of the published packages, so no changeset is needed (matching prior security-bump precedent).

Test plan

• pnpm build in js/ (verified locally)
• CI green on python and chart_data_extractor test suites with pytest 9 / pytest-asyncio 1.x

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Primarily lockfile dependency upgrades, but includes major-version bumps (e.g., pytest 9 and vite 7) that can break CI/tests and tighten runtime/tooling requirements (Python/Node). The updated pytest-asyncio integration changes event-loop/fixture lifecycle and could expose latent async test flakiness or cleanup regressions.

Overview
Resolves Dependabot security alerts by upgrading Python and JS dev/transitive dependencies across the repo (notably pillow 12.2.0, pygments 2.20.0, pytest 9.0.3, pytest-asyncio 1.3.0, and JS toolchain updates like vite 7.3.2, postcss 8.5.12, rollup 4.60.2, esbuild 0.27.7).

Adjusts Python test configuration for the pytest-asyncio 1.x upgrade: updates pytest.ini asyncio settings and refactors async_sandbox_factory teardown to be fully async and manage sandbox cleanup via asyncio.gather instead of a custom session event_loop fixture. Also bumps pytest in template/requirements.txt and refreshes Poetry lockfiles/content hashes.

^{Reviewed by Cursor Bugbot for commit 9cefae1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b529018. Configure here.}