fix(security): patch inherited telemetry pilot dependencies

[seonghobae]

Summary

Repair the six inherited Trivy dependency findings blocking telemetry pilot #1772 and ContextualWisdomLab/.github#1565. A clean develop baseline at 042b0c7 reproduces all six findings.

• AnyIO uv lock: 4.14.1 → 4.14.2 (runtime hash requirements already repaired).
• Next.js and eslint-config-next: 16.2.12 → 16.3.3.
• Existing sharp override: 0.35.0 → 0.35.4; regenerate pnpm lock.
• Pin local Node 24.19.0 via mise to match the existing CI major.

Verification

• Fresh Trivy 0.74.0 dependency scan, same database: clean baseline 6 findings; repaired tree 0.
• Frozen pnpm 11.5.3 install succeeds.
• PYTHONWARNINGS=error: 69 focused backend tests pass.
• Frontend lint and typecheck pass; 437 tests / 51 files pass on repeat without timeout changes. First invocation ran concurrently with build and timed out in one existing five-second UI test (436 passed); that invocation is not green.
• Production build completes successfully (compilation, TypeScript, static pages, and build traces). Hosted full security gates and current-head independent review remain required.

Primary advisories and runnable scan commands are recorded in docs/doctoring/20260927-telemetry-pilot-security-dependencies.md. No scanner exclusions, security gates, or application test timeouts are changed. This PR addresses inherited dependencies separately from telemetry implementation and does not claim deployed telemetry or released SDK evidence.

[coderabbitai]

Warning

Review limit reached

Next included review available in 54 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: ContextualWisdomLab/naruon/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 076360b3-84fe-49ae-85ff-e6de4b1e4a35

📥 Commits

Reviewing files that changed from the base of the PR and between 042b0c7 and 8b8d6a6.

⛔ Files ignored due to path filters (2)

• backend/uv.lock is excluded by !**/*.lock
• frontend/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (4)

• docs/doctoring/20260927-telemetry-pilot-security-dependencies.md
• frontend/package.json
• frontend/pnpm-workspace.yaml
• mise.toml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head admission correction — 8b8d6a6d0bf73b0b4e2fc19e65709284a211e40b

Ready is review admission only. Fresh audit against base 042b0c70531b229af3acbd0421a2f23098d848b3 found:

• latest terminal workflow blockers: CodeQL PR 36315355984=failure

This PR is moved to Draft/Proposed until the causal owner repair is present on a successor exact head and re-audited. Queued/pending work is neither an additional blocker nor passing evidence. No Close, force push, destructive rebase, manual rerun, synthetic status/approval, merge, auto-merge, or bypass was performed.