[DoDiODev]

Summary

Lockfile-only refresh of transitive / indirect dependencies that have
published security advisories. No package.json / pyproject.toml
changes, no forced resolutions: every bump stays within the version
ranges the parent packages already declare.

Dependabot version updates (the only Dependabot mode enabled here) bump
direct dependencies only, so these transitive entries do not move on their
own.

Changes

Python (poetry.lock in pydevlake, plugins/azuredevops,
test/fakeplugin; poetry update --lock urllib3):

Package	Old	New	Advisory
urllib3	2.7.0	2.8.0	several (high/medium)

certifi 2026.10.19 (GHSA-6q48-6c7w-9gw2, critical) already landed via the
python-minor-patch group (#9252) and is not part of this PR.

Go (backend/go.mod, go.sum):

Package	Old	New
github.com/quic-go/quic-go (indirect)	v0.59.0	v0.59.1

config-ui (yarn.lock, yarn up -R …):

• Semver-compatible refresh of lodash, @babel/runtime, @babel/core,
  follow-redirects, mdast-util-to-hast, js-yaml, brace-expansion,
  minimatch, picomatch, browserslist, baseline-browser-mapping,
  cross-spawn, source-map-js.
• node-gyp (Yarn's implicit latest dependency of fsevents)
  10.0.1 → 13.1.0. This moves tar 6.2 → 7.5.22 and drops
  make-fetch-happen@13, socks, ip-address, sprintf-js,
  http-cache-semantics and glob@10.4 from the lockfile. Build-time
  only; fsevents ships prebuilt binaries.
• ahooks@^3.4.1 (required by @ahooksjs/use-url-state) 3.7.10 → 3.10.0,
  the version already used directly; this drops js-cookie@2.2.1.

Not addressed: decode-uri-component@0.2.2 (via query-string@6 ←
@ahooksjs/use-url-state@3.5.1). There is no newer parent release, and
forcing 0.5.x would be a major bump.

Verification

• config-ui: yarn install --immutable, yarn tsc, yarn lint
  (0 errors), yarn test --run (65/65), yarn build.
• backend: go build ./..., go mod verify, go mod tidy -diff.
• Python: poetry check --lock in all three projects; poetry run pytest
  in pydevlake (10 passed) and plugins/azuredevops (8 passed, 1 skipped).
• Fork CI: https://github.com/DoDiODev/devlake/actions/runs/40483961375