Fix open source CVEs, without upgrades

Patch open source CVEs in the versions you are already running (no upgrades).

Fix vulnerabilities in both direct and transitive dependencies.

Get fixes before the CVE, and before a fixed version is released.

Stay compliant without breaking changes or roadmap disruption.