Upgrade authlib to 1.7.x and fix critical vulnerabilities

Dockerfile

@@ -4,6 +4,7 @@ RUN npm install --global pnpm@10.30.3
 
 # Controls whether to build the frontend assets
 ARG skip_frontend_build
+ENV SKIP_FRONTEND_BUILD=${skip_frontend_build}
 
 ENV CYPRESS_INSTALL_BINARY=0
 ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=1
@@ -25,6 +26,11 @@ RUN --mount=type=cache,id=pnpm-store,target=/frontend/.cache/pnpm,uid=1001,gid=1
   pnpm config set store-dir /frontend/.cache/pnpm && \
   if [ "x$skip_frontend_build" = "x" ] ; then pnpm install --frozen-lockfile; fi
 
+# Avoid issues caused by lags in disk and network I/O speeds when working on top of QEMU emulation for multi-platform image building.
+# RUN yarn config set network-timeout 300000
+
+# RUN if [ -z "${SKIP_FRONTEND_BUILD:-}" ] ; then yarn --frozen-lockfile --network-concurrency 1; fi
+
 COPY --chown=redash client /frontend/client
 COPY --chown=redash webpack.config.js /frontend/
 
@@ -39,6 +45,21 @@ RUN --mount=type=cache,id=pnpm-store,target=/frontend/.cache/pnpm,uid=1001,gid=1
   fi
 EOF
 
+# # Use explicit webpack invocation: some environments resolve `webpack` inconsistently after `yarn build:viz`.
+# # `set -ex` surfaces the first failing command (clean, viz, or webpack).
+# RUN if [ -n "${SKIP_FRONTEND_BUILD:-}" ]; then \
+#       mkdir -p /frontend/client/dist \
+#       && touch /frontend/client/dist/multi_org.html \
+#       && touch /frontend/client/dist/index.html; \
+#     else \
+#       set -ex; \
+#       yarn clean; \
+#       yarn build:viz; \
+#       NODE_OPTIONS=--openssl-legacy-provider NODE_ENV=production \
+#         ./node_modules/.bin/webpack build --config ./webpack.config.js; \
+#     fi \
+#     && test -f /frontend/client/dist/index.html
+
 FROM python:3.13-slim-bookworm
 
 EXPOSE 5000
@@ -97,10 +118,12 @@ EOF
 
 WORKDIR /app
 
-ENV POETRY_VERSION=2.1.4
+ENV POETRY_VERSION=2.4.1
 ENV POETRY_HOME=/etc/poetry
 ENV POETRY_VIRTUALENVS_CREATE=false
-RUN curl -sSL --retry 3 --retry-delay 5 https://install.python-poetry.org | python3 -
+
+RUN python3 -m pip install --no-cache-dir --upgrade "pip>=26.1" "setuptools>=78.1.1" "wheel>=0.46.2" \
+  && curl -sSL https://install.python-poetry.org | python3 -
 
 # Avoid crashes, including corrupted cache artifacts, when building multi-platform images with GitHub Actions.
 RUN /etc/poetry/bin/poetry cache clear pypi --all

package.json

@@ -184,6 +184,11 @@
     "fs": false,
     "path": false
   },
+  "resolutions": {
+    "execa": "^5.1.1",
+    "form-data": "^4.0.5",
+    "basic-ftp": "^5.2.0"
+  },
   "//": "browserslist set to 'Async functions' compatibility",
   "browserslist": [
     "Edge >= 15",