Fix web Dependabot alerts and require patched certifi in watcher

docs/site/src/lib/cli-catalog.snapshot.json

@@ -450,5 +450,5 @@
     ]
   },
   "prog": "data-hub-watcher",
-  "version": "1.2.2"
+  "version": "1.2.3"
 }

watcher/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "data-hub-watcher"
-version = "1.2.2"
+version = "1.2.3"
 description = "File-watcher agent for lab instrument PCs that ingests data into Data Hub."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -25,6 +25,9 @@ classifiers = [
 ]
 dependencies = [
     "awscrt>=0.27.0",
+    # Not imported directly. requests trusts certifi's CA bundle, and older
+    # bundles still trust the compromised eMudhra/emSign certificates.
+    "certifi>=2026.10.19",
     "click>=8.2.1",
     "packaging>=24.0",
     "pydantic>=2.11.9",

web/lib/mcp/docs/docs-bundle.snapshot.json

@@ -148,7 +148,7 @@
       "page": "cli-reference",
       "title": "Watcher CLI",
       "description": "Every data-hub-watcher command, subcommand, and flag in one place: init, watch, upload, config, service, state, and self-update.",
-      "markdown": "# Watcher CLI (/docs/cli-reference)\n\n\n\n**For:** Lab operators\n\nFlags and subcommands for `data-hub-watcher`, generated from the Click CLI in the watcher package. For task walkthroughs see [Install and update the watcher](/docs/install-the-watcher), [Run as a Windows service](/docs/windows-service), and [Roll out watcher releases](/docs/watcher-releases).\n\n## Command reference [#command-reference]\n\nThe catalog below lists every command, argument, and option from the installed CLI help text.\n\n## Global flags\n\nThese options apply to every `data-hub-watcher` command (watcher 1.2.2).\n\n**Flags**\n\n- `--config PATH` `path` env: `DATA_HUB_CONFIG_PATH` — Override config file path.\n- `--verbose` `boolean` — Enable debug logging.\n- `--version` `boolean` — Show the version and exit.\n\n## `data-hub-watcher config`\n\nView and manage the watcher config file.\n\n### `data-hub-watcher config edit`\n\nRe-prompt each config field with current values as defaults.\n\n### `data-hub-watcher config open`\n\nOpen the config file in your editor, then re-validate.\n\n**Flags**\n\n- `--editor` `text` — Editor command (e.g. --editor code).\n\n### `data-hub-watcher config path`\n\nPrint the resolved config file path.\n\n### `data-hub-watcher config set-environment`\n\nSwitch the watcher to a different API environment.\n\n**Arguments**\n\n- `ENVIRONMENT` (required) `choice (staging | production | preview)`\n\n**Flags**\n\n- `--api-base-url` `text` — API base URL for the target environment. Required the first time you switch to an environment; reused from config on later switches.\n- `--api-key` `text` — API key for the target environment.\n- `--show-key` `boolean` — Echo the API key as typed (useful on Windows terminals).\n- `--no-register` `boolean` — Fail instead of registering a new watcher if none is stored for the target env.\n\n### `data-hub-watcher config show`\n\nPretty-print the current config.\n\n### `data-hub-watcher config validate`\n\nValidate the config file (offline, no network calls).\n\n## `data-hub-watcher init`\n\nInteractive setup wizard + API registration.\n\n**Flags**\n\n- `--show-key` `boolean` — Echo the API key as it is typed/pasted. Useful on Windows terminals where hidden input is unreliable for paste.\n\n## `data-hub-watcher self-update`\n\nCheck the server for a newer watcher release and upgrade in place. Designed for unattended use — schedule via Windows Task Scheduler (e.g. weekly) so lab PCs converge on the latest published version without operator intervention.\n\n**Flags**\n\n- `--check` `boolean` — Print the server-reported target version without performing the upgrade.\n- `--force` `boolean` — Run the upgrade subprocess even if the local version already matches the target.\n\n## `data-hub-watcher service`\n\nWindows service management.\n\n### `data-hub-watcher service install`\n\nInstall the watcher as a Windows service.\n\n**Flags**\n\n- `--env-path FILE` `file` — Path to the .env file. Defaults to ~/.data-hub/.env.<environment>.\n\n### `data-hub-watcher service reinstall`\n\nStop, uninstall, install, and start the watcher Windows service. Useful after upgrading the watcher wheel from an Administrator shell so the SCM picks up the new ``data_hub_watcher.service`` entrypoint without needing four separate ``service`` invocations.\n\n**Flags**\n\n- `--env-path FILE` `file` — Path to the .env file. Defaults to ~/.data-hub/.env.<environment>.\n\n### `data-hub-watcher service start`\n\nStart the watcher Windows service.\n\n### `data-hub-watcher service status`\n\nShow the watcher Windows service status.\n\n### `data-hub-watcher service stop`\n\nStop the watcher Windows service.\n\n### `data-hub-watcher service uninstall`\n\nUninstall the watcher Windows service.\n\n## `data-hub-watcher state`\n\nInspect or reset the local upload history.\n\n### `data-hub-watcher state forget`\n\nForget upload history under a folder so those files are reported again. Clears every state database a watcher on this PC can open: the one `watch` uses and the one the Windows service uses. Stop the watcher first. It only scans the disk when it starts, so a running watcher will not pick the forgotten files back up.\n\n**Flags**\n\n- `--prefix` (required) `text` — Folder under the watch directory to forget, e.g. alice/.\n- `--yes` `boolean` — Skip the confirmation prompt.\n\n## `data-hub-watcher upload`\n\nUpload files to Data Hub (manual trigger). One-shot mode: pass both --file and --run-id to upload a single file. Queue mode:    omit both to process the server-side upload queue.\n\n**Flags**\n\n- `--file PATH` `path` — Specific file to upload.\n- `--run-id` `text` — Associate upload with a specific run.\n- `--dry-run` `boolean` — Log what would be uploaded without uploading.\n\n## `data-hub-watcher watch`\n\nStart watching for new files.\n\n**Flags**\n\n- `--dry-run` `boolean` — Validate and log but don't start monitoring.\n\n## Interactive setup notes [#interactive-setup-notes]\n\n`init` and `config edit` prompt for values in the terminal. Those prompts are not CLI flags, so they do not appear in the catalog.\n\nKeys must start with `dhub_`. The watcher strips zero-width and non-breaking-space characters that some Windows clipboards inject. See [Install and update the watcher → Configure](/docs/install-the-watcher#configure).\n\n## Upload examples [#upload-examples]\n\nOne-shot upload outside the watch loop:\n\n```sh\ndata-hub-watcher upload --file /path/to/file.csv --run-id RUN001\ndata-hub-watcher upload\ndata-hub-watcher upload --dry-run\n```\n\nPass both `--file` and `--run-id`, or omit both to process the server-side queue in manual mode.\n\n## Switching environments [#switching-environments]\n\n`config set-environment` (and `config edit` when the environment changes) can take `--api-base-url`, `--api-key`, `--show-key`, and `--no-register`. Preview switches require `--api-base-url` the first time. See [Watcher configuration → Switching environments](/docs/configuration-reference#switching-environments).\n\n## Windows service notes [#windows-service-notes]\n\n`service` commands require Windows and the `windows-service` install extra. Use `--env-path` on `service install` and `service reinstall` when the service should load a non-default `.env` file. Full details are in [Run as a Windows service](/docs/windows-service).\n\n## Self-update examples [#self-update-examples]\n\n```sh\ndata-hub-watcher self-update\ndata-hub-watcher self-update --check\ndata-hub-watcher self-update --force\n```\n\nUpgrade behavior depends on how you installed the watcher. See [Install and update the watcher → Manual update](/docs/install-the-watcher#manual-update-self-update).\n"
+      "markdown": "# Watcher CLI (/docs/cli-reference)\n\n\n\n**For:** Lab operators\n\nFlags and subcommands for `data-hub-watcher`, generated from the Click CLI in the watcher package. For task walkthroughs see [Install and update the watcher](/docs/install-the-watcher), [Run as a Windows service](/docs/windows-service), and [Roll out watcher releases](/docs/watcher-releases).\n\n## Command reference [#command-reference]\n\nThe catalog below lists every command, argument, and option from the installed CLI help text.\n\n## Global flags\n\nThese options apply to every `data-hub-watcher` command (watcher 1.2.3).\n\n**Flags**\n\n- `--config PATH` `path` env: `DATA_HUB_CONFIG_PATH` — Override config file path.\n- `--verbose` `boolean` — Enable debug logging.\n- `--version` `boolean` — Show the version and exit.\n\n## `data-hub-watcher config`\n\nView and manage the watcher config file.\n\n### `data-hub-watcher config edit`\n\nRe-prompt each config field with current values as defaults.\n\n### `data-hub-watcher config open`\n\nOpen the config file in your editor, then re-validate.\n\n**Flags**\n\n- `--editor` `text` — Editor command (e.g. --editor code).\n\n### `data-hub-watcher config path`\n\nPrint the resolved config file path.\n\n### `data-hub-watcher config set-environment`\n\nSwitch the watcher to a different API environment.\n\n**Arguments**\n\n- `ENVIRONMENT` (required) `choice (staging | production | preview)`\n\n**Flags**\n\n- `--api-base-url` `text` — API base URL for the target environment. Required the first time you switch to an environment; reused from config on later switches.\n- `--api-key` `text` — API key for the target environment.\n- `--show-key` `boolean` — Echo the API key as typed (useful on Windows terminals).\n- `--no-register` `boolean` — Fail instead of registering a new watcher if none is stored for the target env.\n\n### `data-hub-watcher config show`\n\nPretty-print the current config.\n\n### `data-hub-watcher config validate`\n\nValidate the config file (offline, no network calls).\n\n## `data-hub-watcher init`\n\nInteractive setup wizard + API registration.\n\n**Flags**\n\n- `--show-key` `boolean` — Echo the API key as it is typed/pasted. Useful on Windows terminals where hidden input is unreliable for paste.\n\n## `data-hub-watcher self-update`\n\nCheck the server for a newer watcher release and upgrade in place. Designed for unattended use — schedule via Windows Task Scheduler (e.g. weekly) so lab PCs converge on the latest published version without operator intervention.\n\n**Flags**\n\n- `--check` `boolean` — Print the server-reported target version without performing the upgrade.\n- `--force` `boolean` — Run the upgrade subprocess even if the local version already matches the target.\n\n## `data-hub-watcher service`\n\nWindows service management.\n\n### `data-hub-watcher service install`\n\nInstall the watcher as a Windows service.\n\n**Flags**\n\n- `--env-path FILE` `file` — Path to the .env file. Defaults to ~/.data-hub/.env.<environment>.\n\n### `data-hub-watcher service reinstall`\n\nStop, uninstall, install, and start the watcher Windows service. Useful after upgrading the watcher wheel from an Administrator shell so the SCM picks up the new ``data_hub_watcher.service`` entrypoint without needing four separate ``service`` invocations.\n\n**Flags**\n\n- `--env-path FILE` `file` — Path to the .env file. Defaults to ~/.data-hub/.env.<environment>.\n\n### `data-hub-watcher service start`\n\nStart the watcher Windows service.\n\n### `data-hub-watcher service status`\n\nShow the watcher Windows service status.\n\n### `data-hub-watcher service stop`\n\nStop the watcher Windows service.\n\n### `data-hub-watcher service uninstall`\n\nUninstall the watcher Windows service.\n\n## `data-hub-watcher state`\n\nInspect or reset the local upload history.\n\n### `data-hub-watcher state forget`\n\nForget upload history under a folder so those files are reported again. Clears every state database a watcher on this PC can open: the one `watch` uses and the one the Windows service uses. Stop the watcher first. It only scans the disk when it starts, so a running watcher will not pick the forgotten files back up.\n\n**Flags**\n\n- `--prefix` (required) `text` — Folder under the watch directory to forget, e.g. alice/.\n- `--yes` `boolean` — Skip the confirmation prompt.\n\n## `data-hub-watcher upload`\n\nUpload files to Data Hub (manual trigger). One-shot mode: pass both --file and --run-id to upload a single file. Queue mode:    omit both to process the server-side upload queue.\n\n**Flags**\n\n- `--file PATH` `path` — Specific file to upload.\n- `--run-id` `text` — Associate upload with a specific run.\n- `--dry-run` `boolean` — Log what would be uploaded without uploading.\n\n## `data-hub-watcher watch`\n\nStart watching for new files.\n\n**Flags**\n\n- `--dry-run` `boolean` — Validate and log but don't start monitoring.\n\n## Interactive setup notes [#interactive-setup-notes]\n\n`init` and `config edit` prompt for values in the terminal. Those prompts are not CLI flags, so they do not appear in the catalog.\n\nKeys must start with `dhub_`. The watcher strips zero-width and non-breaking-space characters that some Windows clipboards inject. See [Install and update the watcher → Configure](/docs/install-the-watcher#configure).\n\n## Upload examples [#upload-examples]\n\nOne-shot upload outside the watch loop:\n\n```sh\ndata-hub-watcher upload --file /path/to/file.csv --run-id RUN001\ndata-hub-watcher upload\ndata-hub-watcher upload --dry-run\n```\n\nPass both `--file` and `--run-id`, or omit both to process the server-side queue in manual mode.\n\n## Switching environments [#switching-environments]\n\n`config set-environment` (and `config edit` when the environment changes) can take `--api-base-url`, `--api-key`, `--show-key`, and `--no-register`. Preview switches require `--api-base-url` the first time. See [Watcher configuration → Switching environments](/docs/configuration-reference#switching-environments).\n\n## Windows service notes [#windows-service-notes]\n\n`service` commands require Windows and the `windows-service` install extra. Use `--env-path` on `service install` and `service reinstall` when the service should load a non-default `.env` file. Full details are in [Run as a Windows service](/docs/windows-service).\n\n## Self-update examples [#self-update-examples]\n\n```sh\ndata-hub-watcher self-update\ndata-hub-watcher self-update --check\ndata-hub-watcher self-update --force\n```\n\nUpgrade behavior depends on how you installed the watcher. See [Install and update the watcher → Manual update](/docs/install-the-watcher#manual-update-self-update).\n"
     },
     {
       "page": "security",

web/package.json

@@ -79,7 +79,7 @@
     "tailwind-merge": "^3.5.0",
     "tw-animate-css": "^1.4.0",
     "yaml": "^2.8.3",
-    "zod": "^4.4.3"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.16",
@@ -108,6 +108,7 @@
     "body-parser": "^2.3.0",
     "brace-expansion": "^5.0.7",
     "esbuild": "^0.28.1",
-    "js-yaml": "^4.3.0"
+    "js-yaml": "^4.3.0",
+    "zod": "$zod"
   }
 }