chore(repo): batch dependabot security + lint bumps and clear codeql no-op

.github/workflows/ci.yml

@@ -135,7 +135,9 @@ jobs:
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with: { python-version: "3.12" }
       # Unit deps only — the TrOCR recognizer (transformers/torch) is tier-2 IO, off the unit gate.
-      - run: pip install ruff mypy pytest pytest-cov httpx
+      # Pinned to uv.lock — an unpinned install floats to the newest release, so a lint tool that
+      # changes its defaults reddens every open PR at once. Bump in step with the lockfile.
+      - run: pip install ruff==0.15.20 mypy==2.1.0 pytest==9.1.1 pytest-cov==7.1.0 httpx==0.28.1
       - run: ruff check .
       - run: PYTHONPATH=src mypy --strict src/kitsune_arena_ocr/solver.py src/kitsune_arena_ocr/__init__.py
       - run: PYTHONPATH=src python -m pytest tests/ -q
@@ -147,7 +149,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
         with: { version: "9.12.0" }
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with: { node-version: "22", cache: pnpm, cache-dependency-path: collector/pnpm-lock.yaml }
       - run: pnpm install --frozen-lockfile
       - run: pnpm run typecheck

collector/package.json

@@ -18,16 +18,17 @@
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^3.2.6",
-    "eslint": "^10.6.0",
-    "prettier": "^3.9.4",
+    "eslint": "^10.7.0",
+    "prettier": "^3.9.5",
     "tsup": "^8.3.0",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.63.0",
+    "typescript-eslint": "^8.64.0",
     "vitest": "^3.2.6"
   },
   "pnpm": {
     "overrides": {
       "esbuild": ">=0.28.1",
+      "postcss": ">=8.5.23",
       "vite": "^6.4.3"
     }
   },

detector/src/kitsune_detector/static/home.js

@@ -16,9 +16,9 @@
       if (patch) { for (var k in patch) { if (Object.prototype.hasOwnProperty.call(patch, k)) KS_RESULT[k] = patch[k]; } }
       window.ksResult = KS_RESULT;
       var el = document.getElementById("ks-verdict");
-      // textContent (not innerHTML) on an existing element isn't re-parsed; the \u003c escape is belt-and-
-      // braces so a serialize-then-reparse (outerHTML) of a contradiction detail can't close the tag.
-      if (el) el.textContent = JSON.stringify(KS_RESULT).replace(/</g, "\u003c");
+      // textContent (not innerHTML) is never HTML-parsed, so the JSON is inert as written and the browser
+      // re-escapes it on any outerHTML serialize — no manual escaping needed.
+      if (el) el.textContent = JSON.stringify(KS_RESULT);
       try { dispatchEvent(new CustomEvent("kitsune:result", { detail: KS_RESULT })); } catch (e) {}
     } catch (e) {}
   }

edge/internal/tcpfp/store_test.go

@@ -51,7 +51,7 @@ func TestStoreSweepsExpiredOnPut(t *testing.T) {
 	for i := range 1000 {
 		s.Put(fmt.Sprintf("10.0.%d.%d", i/256, i%256), "linux", 1460, 7, true)
 	}
-	now = now.Add(2 * time.Minute) // every entry above is now past its TTL
+	now = now.Add(2 * time.Minute)           // every entry above is now past its TTL
 	s.Put("1.2.3.4", "linux", 1460, 7, true) // triggers the amortised sweep
 	s.mu.Lock()
 	n := len(s.m)

evaders/arena-solver-ocr/pyproject.toml

@@ -6,7 +6,7 @@ name = "kitsune-arena-ocr"
 version = "0.1.0"
 description = "Browserless OCR solver for the arena's distorted-text gate, using a HuggingFace TrOCR captcha model."
 requires-python = ">=3.11"
-dependencies = ["httpx>=0.27", "transformers>=4.40", "torch>=2.2", "pillow>=10.0"]
+dependencies = ["httpx>=0.27", "transformers>=4.40", "torch>=2.13.0", "pillow>=12.3.0"]
 
 [dependency-groups]
 dev = ["pytest>=8.0", "pytest-cov>=5.0", "mypy>=1.10", "ruff>=0.5"]
@@ -20,6 +20,11 @@ packages = ["src/kitsune_arena_ocr"]
 
 [tool.ruff]
 line-length = 120
+target-version = "py311"
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B", "SIM", "RUF"]
 
 [tool.mypy]
 strict = true

evaders/arena-solver-ocr/tests/test_solver.py

@@ -8,6 +8,7 @@
 
 import httpx
 import pytest
+
 from kitsune_arena_ocr import EthicsError, decode_png_data_uri, is_own_target, solve_text
 
 
@@ -101,6 +102,5 @@ def handler(request: httpx.Request) -> httpx.Response:
 
 
 def test_solve_text_refuses_foreign_target() -> None:
-    with httpx.Client(transport=_fake_gate("X")) as client:
-        with pytest.raises(EthicsError, match="own gates"):
-            solve_text("https://challenges.cloudflare.com", _StubRecognizer("x"), client)
+    with httpx.Client(transport=_fake_gate("X")) as client, pytest.raises(EthicsError, match="own gates"):
+        solve_text("https://challenges.cloudflare.com", _StubRecognizer("x"), client)

fleet/pyproject.toml

@@ -12,8 +12,8 @@ skulk = "skulk.cli:main"
 dev = [
   "pytest>=9.1.1",
   "pytest-cov>=7.1.0",
-  "mypy>=2.2.0",
-  "ruff>=0.15.20",
+  "mypy>=2.3.0",
+  "ruff>=0.15.21",
 ]
 
 [build-system]