fix(security): patch CRITICAL Dependabot findings (python-jose 3.4.0, jspdf 4.2.1)

- python-jose[cryptography] 3.3.0 -> 3.4.0 (CVE-2024-33663 algorithm
  confusion) in backend + api-gateway. App uses HS256 only; encode/decode
  API unchanged; 3.3.0<->3.4.0 tokens cross-verifiable (rolling-deploy safe).
- jspdf 4.0.0 -> 4.2.1 (CVE-2026-31938 HTML injection in new-window paths)
  in frontend; @babel/runtime bumped 7.28.4 -> 7.28.6 (required by jspdf
  4.2.1). App uses only new jsPDF()/autoTable()/doc.save() — vulnerable
  output path not used.

Verified: jose roundtrip + cross-version, frontend npm build, backend &
frontend docker images, and Kubernetes (kind) jose 3.4.0 + frontend serve.
No feature/UI behavior change; backward compatible.

Author: taylanbakircioglu

backend/requirements.txt

@@ -28,7 +28,7 @@ redis[hiredis]==5.0.1
 pika==1.3.2
 
 # Authentication & Security
-python-jose[cryptography]==3.3.0
+python-jose[cryptography]==3.4.0  # CVE-2024-33663 fix (algorithm confusion)
 cryptography>=42.0.4  # CVE-2024-26130, CVE-2023-50782 fix
 passlib==1.7.4
 bcrypt==4.0.1  # Pin bcrypt version for passlib compatibility

frontend/package-lock.json

@@ -20,7 +20,7 @@
     "cytoscape-dagre": "^2.5.0",
     "cytoscape-fcose": "^2.2.0",
     "dagre": "^0.8.5",
-    "jspdf": "^4.0.0",
+    "jspdf": "^4.2.1",
     "jspdf-autotable": "^5.0.7",
     "jszip": "^3.10.1",
     "react": "^18.2.0",

frontend/package.json

@@ -12,7 +12,7 @@ grpcio-tools==1.68.1
 protobuf>=5.29.2  # Security update
 
 # Authentication & Security
-python-jose[cryptography]==3.3.0
+python-jose[cryptography]==3.4.0  # CVE-2024-33663 fix (algorithm confusion)
 cryptography>=42.0.4  # CVE-2024-26130, CVE-2023-50782 fix
 passlib[bcrypt]==1.7.4
 python-dotenv==1.0.0