fix(build): refresh Python dependencies and unblock security CI

[dependabot]

Pull Request

Description

Updated GitPython to 3.1.61, python-hcl2 to 8.1.3, NumPy to 2.5.2 and python-dotenv to 1.2.3. Split the Checkov upgrade into draft #797, retaining Checkov 3.2.531 here and removing its newly introduced ecdsa dependency.

Added commit b13917f to fix the remaining high-severity findings blocking Security Scan. Updated all locked js-yaml v4 copies to 4.3.2 and the docs dependencies to svgo 3.3.5, qs 6.16.0, colord 2.10.0 and joi 17.13.7. No scan thresholds, suppressions, permissions, or workflow failure handling were changed.

Related Issue

Relates to draft #797, which keeps the Checkov-only update blocked pending advisory remediation.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Blueprint modification or addition
• Component modification or addition
• Documentation update
• CI/CD pipeline change
• Other (please describe): Python and npm dependency security maintenance

Implementation Details

The Checkov removal was published as additive commit bfa7d59. The CI fix changes four npm lockfiles (root tools, docs, markdown link checker, chat application) and the docs override floors. Lockfile package sets and root metadata were preserved; only the five identified npm packages changed.

Checkov 3.2.531 requires asteval==1.0.6. Its two medium-severity findings remain visible, below the unchanged high-severity Grype failure threshold. Upgrading asteval independently would violate Checkov's declared requirements, so this PR does not force an incompatible dependency or add an exception.

Testing Performed

• Terraform plan/apply
• Blueprint deployment test
• Unit tests
• Integration tests
• Bug fix includes regression test (see Test Policy)
• Manual validation
• Other: dependency resolution, clean installs, builds and vulnerability scan

Validation on the CI-fix tree:

• Grype 0.116.0 passed using the existing .grype.yaml high-severity policy; only the two medium asteval findings remained. Local generated node_modules/.git/target directories were excluded to represent a clean CI checkout. Hosted CI uses its pinned scanner version and remains authoritative.
• Docs: clean npm ci, 3 suites / 15 tests passed, TypeScript typecheck passed, production build passed. Existing broken-link warnings remain.
• Chat application: clean npm ci, 6 suites / 38 tests passed, server/client production build passed.
• Root and markdown link checker: clean npm ci and local YAML/XML/link-checker smoke checks passed.
• Structured lockfile assertions confirmed patched dependency versions, unchanged package sets/root metadata and no local filesystem dependencies. git diff --check and editor diagnostics passed.
• Earlier Python validation: root Linux x86_64 / Python 3.12 resolution and hash-enforced sync passed for 96 packages, uv pip check passed, Checkov startup returned 3.2.531, and ecdsa was removed. Unchanged ROS2 split files previously passed hash-enforced installation and NumPy/dotenv smoke checks.

Fresh hosted CI was triggered by the latest push; no all-green hosted result is claimed yet. No cloud deployment or full ROS2 integration build was run.

Validation Steps

1. Verify Checkov remains at 3.2.531 and ecdsa is absent.
2. Verify all js-yaml v4 copies are at least 4.3.2 and docs dependencies meet the patched override floors.
3. Require passing Dependency Scan, Security Scan and PR Validation Gate on the final up-to-date head before merging. The user will perform the merge.

Checklist

• I have updated the documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have run terraform fmt on all Terraform code
• I have run terraform validate on all Terraform code
• I have run az bicep format on all Bicep code
• I have run az bicep build to validate all Bicep code
• I have checked for any sensitive data/tokens that should not be committed
• Lint checks pass (run applicable linters for changed file types)

Security Review

• No credentials, secrets, or tokens are hardcoded or logged
• RBAC and identity changes follow least-privilege principles
• No new network exposure or public endpoints introduced without justification
• Dependency additions or updates have been reviewed for known vulnerabilities
• Container image changes use pinned digests or SHA references

No new vulnerability suppressions or reduced enforcement. The two medium asteval advisories remain disclosed; #797 retains the separately blocked ecdsa/Checkov update.

Additional Notes

#797 remains draft and was not changed by this CI fix. No branches were rebased or force-pushed and no PR was merged.

Screenshots (if applicable)

Not applicable.

[dependabot]

Labels

The following labels could not be found: pip. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

requirements.txt

Name	Version	Vulnerability	Severity
ecdsa	0.19.2	Minerva timing attack on P-256 in python-ecdsa	high

Only included vulnerabilities with severity high or higher.

OpenSSF Scorecard

Package	Version	Score	Details
pip/ecdsa	0.19.2	🟢 5.8	Details Check Score Reason Maintained 🟢 8 9 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 8 Security-Policy 🟢 10 security policy file detected Code-Review 🟢 3 Found 5/15 approved changesets -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing 🟢 10 project is fuzzed License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 8 SAST tool detected but not run on all commits
pip/bc-detect-secrets	1.5.50	Unknown	Unknown
pip/checkov	3.3.16	🟢 7	Details Check Score Reason Maintained 🟢 10 30 commit(s) out of 30 and 7 issue activity out of 30 found in the last 90 days -- score normalized to 10 Code-Review 🟢 3 11 out of last 30 changesets reviewed before merge -- score normalized to 3 Vulnerabilities 🟢 10 no vulnerabilities detected CII-Best-Practices ⚠️ 2 badge detected: in_progress Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches Token-Permissions ⚠️ 0 non read-only tokens detected in GitHub workflows Security-Policy 🟢 10 security policy file detected License 🟢 10 license file detected Dependency-Update-Tool 🟢 10 update tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 10 SAST tool is run on all commits Binary-Artifacts 🟢 10 no binaries found in the repo Packaging 🟢 10 publishing workflow detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0
pip/gitpython	3.1.61	🟢 7.2	Details Check Score Reason Code-Review ⚠️ 1 Found 2/11 approved changesets -- score normalized to 1 Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches SAST 🟢 10 SAST tool is run on all commits
pip/numpy	2.5.2	Unknown	Unknown
pip/python-hcl2	8.1.3	Unknown	Unknown
pip/numpy	2.5.2	Unknown	Unknown
pip/python-dotenv	1.2.3	Unknown	Unknown

Scanned Files

• requirements.txt
• src/500-application/506-ros2-connector/services/requirements.base.txt

[github-actions]

📚 Documentation Health Report

Generated on: 2026-09-09 12:47:25 UTC

📈 Documentation Statistics

Category	File Count
Main Documentation	223
Infrastructure Components	230
Blueprints	40
GitHub Resources	26
AI Assistant Guides (Copilot)	17
Total	536

🏗️ Three-Tree Architecture Status

• ✅ Bicep Documentation Tree: Auto-generated navigation
• ✅ Terraform Documentation Tree: Auto-generated navigation
• ✅ README Documentation Tree: Manual README organization

🔍 Quality Metrics

• Frontmatter Validation:
  success
• Link Validation: success

---

This report is automatically generated by the Documentation Automation workflow.

[github-actions]

📚 Documentation Health Report

Generated on: 2026-09-09 22:47:47 UTC

📈 Documentation Statistics

Category	File Count
Main Documentation	223
Infrastructure Components	230
Blueprints	40
GitHub Resources	26
AI Assistant Guides (Copilot)	17
Total	536

🏗️ Three-Tree Architecture Status

• ✅ Bicep Documentation Tree: Auto-generated navigation
• ✅ Terraform Documentation Tree: Auto-generated navigation
• ✅ README Documentation Tree: Manual README organization

🔍 Quality Metrics

• Frontmatter Validation:
  success
• Link Validation: success

---

This report is automatically generated by the Documentation Automation workflow.