chore(deps): consolidated dependency bumps (setuptools, fast-uri, tar, shell-quote, svgo) (#10199)

Supersedes 7 open Dependabot PRs by applying the safe ones and
properly fixing the one with a broken lockfile, in one CI cycle:

- setuptools ==82.* -> ==83.* (#10144, #10145 - duplicate PRs, same
  patch). Only touches the `python_version > '3.9'` line; the
  `<82; python_version <= '3.9'` gate for Python 3.9 is untouched,
  so this doesn't affect Python 3.9 support.
- fast-uri 3.1.2 -> 3.1.4 in both /web and /runtime (#10183, #10195)
  - fixes two real CVEs (GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6).
- tar 7.5.16 -> 7.5.21 (#10182) - patch series, decompression-bomb
  and unbounded-recursion hardening only.
- shell-quote 1.8.4 -> 1.10.0 (#10185) - additive opt-in option +
  parser fixes, no breaking changes.
- svgo 3.3.3 -> 4.0.2 (#10184) - Dependabot's own PR left yarn.lock
  internally inconsistent (dropped the workspace-level `svgo` entry
  while merging version-range blocks), so `yarn install --immutable`
  failed in CI with "the lockfile would have been modified by this
  install". Regenerated properly via `yarn up`/`yarn dedupe` here.
  The direct `svgo`/`svgo-loader` deps are not actually wired into
  any webpack rule (verified via grep) - the real SVG pipeline is
  `@svgr/webpack` -> `@svgr/plugin-svgo` -> svgo 3.3.3, which this
  bump does not touch - so the major version jump has no build
  impact. `yarn.lock` now correctly keeps that separate 3.3.3
  resolution alongside the deduped 4.0.2 one.

Not included (structurally blocked, tracked separately):
- paramiko 3.5.1 -> 5.0.0 (#9927): paramiko 5 removes DSSKey
  entirely; sshtunnel 0.4.0 (dormant since 2021) still references
  paramiko.DSSKey, so `import sshtunnel` would crash immediately.
- pywinpty 2.0.* -> 3.0.* (#10082, #10084): the existing pin cites
  https://github.com/andfoy/pywinpty/issues/545, confirmed still
  open ("process read and write not working as expected in 3.x").

Verified: `yarn install --immutable` clean in both /web and
/runtime, `yarn run linter` clean, full `yarn run bundle:dev`
compiles successfully.

requirements.txt

@@ -56,7 +56,7 @@ pytz==2026.*
 pywinpty==2.0.*; sys_platform=="win32"
 qrcode[pil]==8.*
 setuptools<82; python_version <= '3.9'
-setuptools==82.*; python_version > '3.9'
+setuptools==83.*; python_version > '3.9'
 SQLAlchemy==2.*
 sqlparse==0.*
 sshtunnel==0.*

runtime/yarn.lock

@@ -708,9 +708,9 @@ __metadata:
   linkType: hard
 
 "fast-uri@npm:^3.0.1":
-  version: 3.1.2
-  resolution: "fast-uri@npm:3.1.2"
-  checksum: 10c0/5b35641895959f3f7ab7a7b1b5542bded159346f25ec9f256817b206d50b64eda5828e90d605a2e2fc645c90519a7259c2bab2c942ee728c88b88e5be21b090d
+  version: 3.1.4
+  resolution: "fast-uri@npm:3.1.4"
+  checksum: 10c0/f90948821ceb49980f64f89b8216ba498f5957f26035be813526a55b6145d26cbd63ef5618d5205a3292b31edc9c08589749350cd72bd86c7095eb434dceb757
   languageName: node
   linkType: hard
 

web/package.json

@@ -57,7 +57,7 @@
     "shim-loader": "^1.0.1",
     "style-loader": "^4.0.0",
     "stylis": "^4.4.0",
-    "svgo": "^4.0.2",
+    "svgo": "4.0.2",
     "svgo-loader": "^4.0.0",
     "terser-webpack-plugin": "^5.6.1",
     "typescript": "^6.0.3",
@@ -167,7 +167,7 @@
     "ws": "^8.20.1",
     "qs": "^6.15.2",
     "@tootallnate/once": "^2.0.1",
-    "tar@npm:^7.5.4": "^7.5.15",
+    "tar@npm:^7.5.4": "^7.5.21",
     "ttf2woff2/node-gyp": "^11.2.0",
     "js-yaml@npm:^3.13.1": "^3.15.0",
     "form-data@npm:^4.0.5": "^4.0.6",

web/yarn.lock

@@ -7895,9 +7895,9 @@ __metadata:
   linkType: hard
 
 "fast-uri@npm:^3.0.1":
-  version: 3.1.2
-  resolution: "fast-uri@npm:3.1.2"
-  checksum: 10c0/5b35641895959f3f7ab7a7b1b5542bded159346f25ec9f256817b206d50b64eda5828e90d605a2e2fc645c90519a7259c2bab2c942ee728c88b88e5be21b090d
+  version: 3.1.4
+  resolution: "fast-uri@npm:3.1.4"
+  checksum: 10c0/f90948821ceb49980f64f89b8216ba498f5957f26035be813526a55b6145d26cbd63ef5618d5205a3292b31edc9c08589749350cd72bd86c7095eb434dceb757
   languageName: node
   linkType: hard
 
@@ -13325,7 +13325,7 @@ __metadata:
     sql-formatter: "npm:^15.8.2"
     style-loader: "npm:^4.0.0"
     stylis: "npm:^4.4.0"
-    svgo: "npm:^4.0.2"
+    svgo: "npm:4.0.2"
     svgo-loader: "npm:^4.0.0"
     terser-webpack-plugin: "npm:^5.6.1"
     typescript: "npm:^6.0.3"
@@ -13677,9 +13677,9 @@ __metadata:
   linkType: hard
 
 "shell-quote@npm:^1.6.1":
-  version: 1.8.4
-  resolution: "shell-quote@npm:1.8.4"
-  checksum: 10c0/86c93678bc394cb81f5ddcdc87df9c95d279ef9652775cd1cd1eed361404169a8d8cbaacaeed232ab09919e36ee1e5363863570390d78571f8c22b7f6312fb40
+  version: 1.10.0
+  resolution: "shell-quote@npm:1.10.0"
+  checksum: 10c0/46ee59bfd972ce6a45500c44ed130dff2d0a7d6fbac9841e59d548518cad8060a06393c9a5dcbc0cede294ad80b2a2cd8c904679e09265f53efc0a0879f30961
   languageName: node
   linkType: hard
 
@@ -14418,6 +14418,23 @@ __metadata:
   languageName: node
   linkType: hard
 
+"svgo@npm:4.0.2, svgo@npm:^4.0.1":
+  version: 4.0.2
+  resolution: "svgo@npm:4.0.2"
+  dependencies:
+    commander: "npm:^11.1.0"
+    css-select: "npm:^5.1.0"
+    css-tree: "npm:^3.0.1"
+    css-what: "npm:^6.1.0"
+    csso: "npm:^5.0.5"
+    picocolors: "npm:^1.1.1"
+    sax: "npm:^1.5.0"
+  bin:
+    svgo: ./bin/svgo.js
+  checksum: 10c0/d58c9446d2701dd57ef62a29b4299b157cfc32e2282f82fc68dd7cdca2e1efdf0d8bb0fb30ba0499f322d20b6304be277ffbc60a6b6a75489fa30c5300694b9a
+  languageName: node
+  linkType: hard
+
 "svgo@npm:^3.0.0, svgo@npm:^3.0.2":
   version: 3.3.3
   resolution: "svgo@npm:3.3.3"
@@ -14435,40 +14452,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"svgo@npm:^4.0.1":
-  version: 4.0.1
-  resolution: "svgo@npm:4.0.1"
-  dependencies:
-    commander: "npm:^11.1.0"
-    css-select: "npm:^5.1.0"
-    css-tree: "npm:^3.0.1"
-    css-what: "npm:^6.1.0"
-    csso: "npm:^5.0.5"
-    picocolors: "npm:^1.1.1"
-    sax: "npm:^1.5.0"
-  bin:
-    svgo: ./bin/svgo.js
-  checksum: 10c0/f61f9957b42e0c97593b49a01f3b93cb239b2e818efccb056fcc866d622704d9021c4ef8bd0287264c3e4f33da60e4af14d841b4a624b87ff8888e3b896d13d5
-  languageName: node
-  linkType: hard
-
-"svgo@npm:^4.0.2":
-  version: 4.0.2
-  resolution: "svgo@npm:4.0.2"
-  dependencies:
-    commander: "npm:^11.1.0"
-    css-select: "npm:^5.1.0"
-    css-tree: "npm:^3.0.1"
-    css-what: "npm:^6.1.0"
-    csso: "npm:^5.0.5"
-    picocolors: "npm:^1.1.1"
-    sax: "npm:^1.5.0"
-  bin:
-    svgo: ./bin/svgo.js
-  checksum: 10c0/d58c9446d2701dd57ef62a29b4299b157cfc32e2282f82fc68dd7cdca2e1efdf0d8bb0fb30ba0499f322d20b6304be277ffbc60a6b6a75489fa30c5300694b9a
-  languageName: node
-  linkType: hard
-
 "svgpath@npm:^2.1.5":
   version: 2.6.0
   resolution: "svgpath@npm:2.6.0"
@@ -14515,7 +14498,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tar@npm:^7.4.3, tar@npm:^7.5.15":
+"tar@npm:^7.4.3":
   version: 7.5.16
   resolution: "tar@npm:7.5.16"
   dependencies:
@@ -14528,6 +14511,19 @@ __metadata:
   languageName: node
   linkType: hard
 
+"tar@npm:^7.5.21":
+  version: 7.5.21
+  resolution: "tar@npm:7.5.21"
+  dependencies:
+    "@isaacs/fs-minipass": "npm:^4.0.0"
+    chownr: "npm:^3.0.0"
+    minipass: "npm:^7.1.2"
+    minizlib: "npm:^3.1.0"
+    yallist: "npm:^5.0.0"
+  checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc
+  languageName: node
+  linkType: hard
+
 "terser-webpack-plugin@npm:^5.6.1":
   version: 5.6.1
   resolution: "terser-webpack-plugin@npm:5.6.1"