c963acb574
GHSA-xjvp-7243-rg9h (wish SCP middleware path traversal) is not exploitable — uptop only uses bubbletea middleware. Scan still runs and warns but won't fail the release.