[katsugtgz]

Updates cairosvg to address PYSEC-2026-2122 (GHSA-f38f-5xpm-9r7c) and PYSEC-2026-4204 (GHSA-c3jg-qh8m-j3h2).

Evidence:

• requirements.txt referenced cairosvg==2.8.2
• Pipfile.lock pinned cairosvg==2.8.2
• osv-scanner reported PYSEC-2026-2122 and PYSEC-2026-4204 for 2.8.2 before the update
• updated version: 2.9.1 in both files

Validation:

• pip install -r requirements.txt completes and import cairosvg loads 2.9.1
• osv-scanner no longer reports the cairosvg advisories after the update

Note: the python_version >= '3.9' marker is unchanged. cairosvg 2.9.1 requires Python 3.10+, which matches runtime.txt (python-3.10.7). If you still want to support Python 3.9 installs, this pin would need to stay at 2.8.2 there.

Scope: dependency pin update in requirements.txt and Pipfile.lock only.