Merge branch 'phase-9' into config-review

The CI dependency scan flags GHSA-6c7f-9265-g8fw, GHSA-jr96-gvgh-j3r4
and GHSA-gmh7-3g9r-mjh5 against 6.21.1, all fixed in 6.21.2.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.gitea/workflows/ci.yml

@@ -174,7 +174,7 @@ jobs:
       - name: Generate feed fixtures
         run: |
           set -euo pipefail
-          python -m pip install pypdf==6.21.1
+          python -m pip install pypdf==6.21.2
           python -m tests.fixtures.generator --out tests/fixtures/generated
           # The Playwright container writes state; the worker reads as uid 10001.
           chmod -R a+rwX tests/fixtures/generated

CHANGELOG.md

@@ -20,7 +20,7 @@ All notable changes to this project are recorded here. The format follows [Keep
 
 ### Changed
 
-- Security fixes in the pinned dependencies, found by the new CI scan: `pypdf` 6.21.0 to 6.21.1 (GHSA-5hx5-vpf9-5wcv, a crafted PDF could reach the image parsers) and `certifi` 2026.7.22 to 2026.10.19 (PYSEC-2026-4320, a distrusted root removed). The image must be rebuilt for both to reach the stacks.
+- Security fixes in the pinned dependencies, found by the new CI scan: `pypdf` 6.21.0 to 6.21.2 (GHSA-5hx5-vpf9-5wcv, a crafted PDF could reach the image parsers; 6.21.2 for GHSA-6c7f-9265-g8fw, GHSA-jr96-gvgh-j3r4 and GHSA-gmh7-3g9r-mjh5) and `certifi` 2026.7.22 to 2026.10.19 (PYSEC-2026-4320, a distrusted root removed). The image must be rebuilt for both to reach the stacks.
 - `POST /api/admin/ad/refresh` no longer runs the AD refresh in the request. It asks the worker for an `ad-reconcile` run and answers 202 `{requested, pending, job}`; `GET /api/admin/ad/reconcile` gives the latest report.
 - The storage quota alert is now mailed through the Notifications rules (to PS-Admins by default), with a "Cleared" message when usage drops back.
 - The session, lock and sign-in limit settings can be overridden on the Admin Security tab; the environment values are the defaults.

docs/DEPLOY.md

@@ -285,7 +285,7 @@ The real PESCO domain controllers are never used by CI. The test and production
 CI never reads VISUAL or M-Files. `deploy/ci/ci.env` sets `FEED_SOURCE=fixture`, `DRAWING_SOURCE=fixture` and `FIXTURE_DIR=/fixtures`. The image does not contain `tests/`, so the e2e job generates the fixtures on the runner before the stack starts:
 
 ```bash
-python -m pip install pypdf==6.21.1
+python -m pip install pypdf==6.21.2
 python -m tests.fixtures.generator --out tests/fixtures/generated
 ```
 
@@ -313,7 +313,7 @@ job workspace on a host directory allowed in `valid_volumes` (so the stack's bin
 
 ## Image rebuild for phase 9
 
-Phase 9 bumps two pins for security fixes found by the CI dependency scan: `pypdf` 6.21.0 to 6.21.1 and `certifi` 2026.7.22 to 2026.10.19 (`server/requirements.txt` and `pyproject.toml`). They reach a stack only with a new image. Build and tag the phase 9 commit as usual (`:sha-<sha>` from CI), set it in the stack's env file, and `up -d`. Migration 0010 runs on the way up. Then run the doctor.
+Phase 9 bumps two pins for security fixes found by the CI dependency scan: `pypdf` 6.21.0 to 6.21.2 and `certifi` 2026.7.22 to 2026.10.19 (`server/requirements.txt` and `pyproject.toml`). They reach a stack only with a new image. Build and tag the phase 9 commit as usual (`:sha-<sha>` from CI), set it in the stack's env file, and `up -d`. Migration 0010 runs on the way up. Then run the doctor.
 
 ## Notifications (phase 9)
 

pyproject.toml

@@ -22,7 +22,7 @@ dependencies = [
     "apscheduler>=3.11,<4",
     "httpx>=0.28",
     "tzdata>=2026.5",
-    "pypdf==6.21.1",
+    "pypdf==6.21.2",
     "python-multipart==0.0.32",
     "pypdfium2==5.14.0",
     "openpyxl==3.1.5",

server/requirements.txt

@@ -15,7 +15,7 @@ argon2-cffi==25.1.0
 apscheduler==3.11.3
 httpx==0.28.1
 tzdata==2026.5
-pypdf==6.21.1
+pypdf==6.21.2
 python-multipart==0.0.32
 pypdfium2==5.14.0
 openpyxl==3.1.5