[YusukeKato]

Dependabot PRs #232–#241 independently update overlapping dependency locks. This PR integrates those exact target versions so the combined runtime and browser stack receives its own CI and one reviewed production promotion.

• Runtime: FastAPI 0.162.4, Pydantic 2.14.3 / core 2.50.4; Python range remains 3.12–3.14 and locked AnyIO 4.15.1 satisfies the new runtime minimum.
• Development/browser: Ruff 0.17.4 and Playwright 1.65.0 (pyee removed upstream; typing-extensions only loses its e2e group).
• Frontend tooling: jsdom 31.0.0, ESLint React 5.30.1, TypeScript ESLint 8.72.2, React plugin 6.3.0, Vite 8.3.8. Node 22.23.5 satisfies their engines. jsdom 31 changes the optional canvas backend to @napi-rs/canvas; SOJ's DOM suite does not install/use either canvas backend. Parser/readiness and CSS compatibility are checked by existing DOM tests, while actual rendering/browser behavior is covered by Playwright. No canvas backend or new browser mode is added.
• CI: setup-docker-action v5.7.0 pinned to verified official tag commit 3f1ab1ab0e29231562e4db4ca600c1a49653bac6; explicit Docker v29.9.2/rootless settings and permissions stay the same.
• Reconciled shared locks, preserving Undici 8.12.4, existing Zod 4.6.6 and ESLint React's separately resolved Zod 4.6.7. No global lint-rule relaxation or scan exception.

Validation on the combined diff: Poetry 2.5.1 check/install and pip check; Ruff/format/mypy; Python 1099 passed; frontend format/lint/typecheck/127 tests/build with frozen Yarn lock; changed actual backend/runner/frontend/browser images built on the explicit rootless daemon; runtime boundary/API/judgment/DB persistence 18 passed, no skips. CA-bearing runtime/browser stores reject all 12 distrusted fixtures and accept the legitimate control, including the fixed private Node. Initial local CA selection mistakenly included the intentionally CA-free, network-isolated sandbox; corrected to documented targets without a product-code or policy change.

Only six files change: dependency manifests/locks, the three Action references, and update history. Product version remains 3.0.3; all 148 problem definitions/images, API/DB schema, TLS/CA policy and sandbox restrictions remain unchanged. PR/main CI must verify full148 Compose regression, all problem screens and scans; merge, signed promotion and public confirmation follow only after exact-head success. Local full Compose/browser repetition is left to those CI gates. Unapproved comm/ln proposals are excluded.

Originals will be checked again after production verification; any newer unincorporated update must be retained.

[YusukeKato]

本番確認まで完了しました。main ac21b21db8261b1909411c7bb190a3eae1a48cd7 の全CI・署名と本番配備が成功しました。

• Python 3.12/3.13/3.14 各1,099件、frontend 127件、全148問回帰を含むCompose 69件成功。ブラウザ検査は別の3 jobで成功（Composeのbrowser 1件は重複実行を避けてdeselect）。ローカルでも基本検査、実image 18件、CA対象の検査を完了。
• 公開148問・問題詳細/画像、配備imageのindex digest一致、日英・320/1440幅の画面を確認。chmod正解提出ID327は20 UTF-8 bytes完全一致、画像問題ID328もAccepted。両方とも persistence=saved、各1回の提出で応答原文を保持。実機iOS/Androidは未確認。
• スキャンの停止対象は0件ですが、検出そのものが0件という意味ではありません。例外・risk acceptanceの追加なし。
• primary mainをff同期しcleanを確認、今回の作業branchを削除済み。元10件のうち7件はDependabot自身がclose・branch削除。build(deps): bump fastapi from 0.162.4 to 0.162.5 #234/build(deps-dev): bump playwright from 1.65.0 to 1.65.1 #236/#240はさらに新しい0.162.5/1.65.1/5.30.2へ更新されており、未取り込み分を保持して別途確認中です。

新規問題案はこの変更に含めていません。

[YusukeKato]

続報: 未取り込みとして保持した#234/#236/#240の新しい3修正版も、最終main e8bee7b2d4e6e2957b8bcbc51053fed57bd24cb6 の全CI・署名・本番配備・公開確認まで完了しました。公開中PR0件、リモートmainのみです。検証範囲と未確認事項は#240の完了記録を参照してください。