fix(deps): bump vulnerable transitive deps in uv.lock and dashboard lockfile

[smoochy]

Lockfile-only security bumps, all within existing semver ranges:

Package	From	To	Advisories
aiohttp	3.13.5	3.14.1	11 GHSAs (websocket/limits/redirect issues)
starlette	1.1.0	1.3.1	GHSA-82w8-qh3p-5jfq (high), GHSA-jp82-jpqv-5vv3
pydantic-settings	2.14.1	2.14.2	GHSA-4xgf-cpjx-pc3j
hono	4.12.21	4.12.29	5 GHSAs incl. GHSA-88fw-hqm2-52qc (CORS, high)
qs	6.15.1	6.15.3	GHSA-q8mj-m7cp-5q26
@babel/core	7.29.0	7.29.7	GHSA-4x5r-pxfx-6jf8

Verified: uv lock --check passes; npm ci in plugin/dashboard passes; package.json untouched; lockfileVersion unchanged.

Note: npm resolved hono/qs/@babel/core to the latest patch within their existing semver ranges (4.12.29 / 6.15.3 / 7.29.7), which meet or exceed the advisory-fixed versions.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• plugin/dashboard/package-lock.json is excluded by !**/package-lock.json
• plugin/uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 176c6736-6f3f-42ea-bcc4-9ccbac56cf6f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}