chore: roll up legacy Dependabot security fixes

[openai0229]

Chat2DB Edition

Chat2DB Community

Task Category

Contributor infrastructure

Problem

After security grouping was enabled in #2208, Dependabot could not refresh the existing npm security pull requests because its updater failed in DependencyChangeBuilder with Pathname.new requires a String. Closing the legacy pull requests and re-enabling Dependabot security updates did not immediately generate grouped replacements, so the existing fixes need deterministic replacement pull requests without restoring one pull request per dependency.

Scope

• Create one npm security rollup from the 16 closed Dependabot security pull request heads.
• Create one Maven security rollup from the two closed Dependabot security pull request heads.
• Keep npm and Maven changes in separate pull requests.
• Preserve the grouped future-update policy merged in ci(dependabot): group related dependency updates #2208.
• Close or supersede only dependency pull requests whose exact changes are represented by a rollup.

Non-goals

• Merge dependency upgrades without review and CI.
• Combine npm and Maven changes into one cross-ecosystem pull request.
• Change application business code.
• Dismiss or close Dependabot security alerts.
• Modify intentionally individual major-version update pull requests.

Completion Criteria

• One npm rollup contains the lockfile changes from all 16 legacy npm security pull requests.
• One Maven rollup contains the BOM changes from both legacy Maven security pull requests.
• Each rollup is based on current main, has a reviewable dependency list, and passes the applicable repository checks.
• Dependabot security updates remain enabled with the grouped configuration from ci(dependabot): group related dependency updates #2208.
• No legacy per-dependency security pull request remains open without a replacement.

Verification

• Compare each rollup diff with the source Dependabot pull request head commits.
• Run frontend lockfile installation and repository checks for the npm rollup.
• Run Maven validation for the Maven rollup.
• Inspect GitHub checks and the final open Dependabot pull request inventory.
• Read back representative Dependabot alerts to confirm they remain open until fixes merge.

Contribution

I can submit a pull request

Submission Checklist

• I searched existing Issues and Discussions for duplicates.
• I selected the affected Chat2DB edition.
• This proposal does not include credentials, private data, or unpublished vulnerability details.

[github-actions]

Thanks for the detailed maintenance proposal. The request is understood as two separate, reviewable security rollups based on current main: one npm pull request representing all 16 closed legacy Dependabot heads, and one Maven pull request representing both closed legacy heads, while preserving the grouped policy from #2208.

The next step for maintainer review is to confirm the exact source pull request inventory before submission, then compare each rollup against those head commits and run the ecosystem-specific checks described here. Dependency pull requests should only be treated as superseded when their exact changes are included.

``

Generated by AI Issue Assistant for #2231 · 3.87 AIC · ⌖ 3.01 AIC · ⊞ 16.4K · ◷