fix(security): address all Dependabot vulnerability alerts

hindsight-api-slim/pyproject.toml

@@ -45,15 +45,18 @@ dependencies = [
     "obstore>=0.4.0", # S3/GCS/Azure object storage client (Rust-backed)
     "uvloop>=0.22.1",
     # Transitive dependency security fixes
-    "pyasn1>=0.6.2", # DoS vulnerability fix
+    "pyasn1>=0.6.3", # DoS vulnerability fix
     "urllib3>=2.6.3", # Decompression-bomb safeguards bypass fix
     "langchain-core>=1.2.11", # Serialization injection + SSRF vulnerability fix
     "langsmith>=0.6.3", # SSRF via tracing header injection fix
     "protobuf>=6.33.5", # JSON recursion depth bypass fix
     "pillow>=12.1.1", # Out-of-bounds write in PSD image loading fix
     "cryptography>=46.0.5", # Subgroup attack vulnerability fix
     "filelock>=3.20.1", # TOCTOU race condition fix
-    "authlib>=1.6.6", # Account takeover vulnerability fix
+    "authlib>=1.6.9", # Account takeover/JWS header injection vulnerability fix
+    "pyjwt>=2.12.0", # Accepts unknown crit header extensions fix
+    "orjson>=3.11.6", # Unbounded recursion DoS fix
+    "tornado>=6.5.5", # DoS multipart/incomplete cookie validation fix
     "aiohttp>=3.13.3", # Multiple DoS vulnerabilities
     "claude-agent-sdk>=0.1.27; sys_platform == 'darwin'",
 ]

hindsight-control-plane/package.json

@@ -55,7 +55,7 @@
     "eslint": "^9.39.1",
     "eslint-config-next": "^16.0.1",
     "lucide-react": "^0.553.0",
-    "next": "^16.1.6",
+    "next": "^16.1.7",
     "next-themes": "^0.4.6",
     "postcss": "^8.5.6",
     "react": "^19.2.0",

hindsight-integration-tests/pyproject.toml

@@ -16,6 +16,7 @@ dependencies = [
     "httpx>=0.27.0",
     # Transitive dependency security fixes
     "cryptography>=46.0.5", # Subgroup attack vulnerability fix
+    "pyjwt>=2.12.0", # Accepts unknown crit header extensions fix
 ]
 
 [tool.hatch.build.targets.wheel]

hindsight-integrations/crewai/pyproject.toml

@@ -32,6 +32,7 @@ dependencies = [
     # Transitive dependency security fixes
     "cryptography>=46.0.5", # Subgroup attack vulnerability fix
     "pillow>=12.1.1", # Out-of-bounds write in PSD image loading fix
+    "pyjwt>=2.12.0", # Accepts unknown crit header extensions fix
 ]
 
 [project.optional-dependencies]