Maintenance sweep: sample-apps

[jhamon]

Repo maintenance sweep for sample-apps (PIN-2 baseline audit). This is a monorepo of four independent sample apps, each with its own manifest, lockfile, and README:

• legal-semantic-search — Next.js 15 + LangChain + Pinecone JS v4 (npm)
• namespace-notes — Next.js 15 client + Express/Node TS server (Pinecone JS v2, AWS S3) (npm)
• pinecone-assistant — Next.js 15 (pnpm)
• shop-the-look — Next.js 15 frontend + FastAPI Python backend, pinecone-client v4 (npm + pip)

Substantive items are tracked as child issues; trivia are checkboxes here. Safety-net ordering: CI (#71) lands before the dependency-major / SDK work (#73, #74).

Theme 1 — Discoverability & Presentation

• Add repo topics (none set): pinecone, sample-apps, vector-search, rag, nextjs, fastapi — gh repo edit --add-topic …
• Add an app-index table to the root README (name + one-line pitch + stack + link per app)
• Confirm community-health coverage (no CONTRIBUTING.md / CODE_OF_CONDUCT.md / SECURITY.md in-repo — verify org .github defaults apply)
• Description present; homepage set; LICENSE (MIT) present and correct — no action.

Theme 2 — Cleanup & Repo Hygiene

• Dependency & lockfile hygiene: clear medium/low Dependabot, regenerate lockfiles, fix broken/unpinned deps #73 Dependency & lockfile hygiene — includes broken file: deps in legal-semantic-search, .gitignore __pycache__ corruption, namespace-notes/server package metadata (name/author/license ISC→MIT)

Theme 3 — Testing + CI Foundation (safety net)

• Add CI: GitHub Actions matrix (lint + typecheck + build) over all sample apps #71 Add CI: GitHub Actions matrix (lint + typecheck + build) over all apps — HIGH PRIORITY (no CI exists; a separate CI PR will close this)
• Establish test scaffolding across sample apps (currently zero tests) #75 Establish test scaffolding across sample apps (currently zero tests) — depends on Add CI: GitHub Actions matrix (lint + typecheck + build) over all sample apps #71

Theme 4 — Dependency Hygiene

• Clear the 2 critical + 11 high Dependabot alerts — owned by the separate Security fast-track (crit/high fleet remediation), not this sweep
• Dependency & lockfile hygiene: clear medium/low Dependabot, regenerate lockfiles, fix broken/unpinned deps #73 Clear remaining medium/low Dependabot alerts + regenerate lockfiles (depends on Add CI: GitHub Actions matrix (lint + typecheck + build) over all sample apps #71)
• Upgrade & unify Pinecone SDK across apps (namespace-notes/server v2, python pinecone-client, next-auth beta) #74 Upgrade & unify Pinecone SDK across apps (namespace-notes/server v2, python pinecone-client, next-auth beta) — depends on Add CI: GitHub Actions matrix (lint + typecheck + build) over all sample apps #71

Theme 5 — Security

• Resolve 13 open code-scanning alerts in namespace-notes (path-injection, SSRF, rate-limiting) #72 Resolve 13 open code-scanning alerts in namespace-notes (10× path-injection, 2× critical SSRF, 1× missing-rate-limiting) — depends on Add CI: GitHub Actions matrix (lint + typecheck + build) over all sample apps #71
• Least-privilege GITHUB_TOKEN (contents: read) — established as part of Add CI: GitHub Actions matrix (lint + typecheck + build) over all sample apps #71

Theme 6 — Docs

• Sync each app's README snippets to the upgraded SDK versions (depends on Upgrade & unify Pinecone SDK across apps (namespace-notes/server v2, python pinecone-client, next-auth beta) #74)

Theme 7 — UX & Small Correctness

• Pin shop-the-look Python deps (python-multipart, Pillow; verify requests pin) — folded into Dependency & lockfile hygiene: clear medium/low Dependabot, regenerate lockfiles, fix broken/unpinned deps #73
• Remove broken file: deps so a clean install works — folded into Dependency & lockfile hygiene: clear medium/low Dependabot, regenerate lockfiles, fix broken/unpinned deps #73

---

Child issues: #71 (CI), #72 (code-scanning), #73 (dep/lockfile hygiene), #74 (SDK upgrade), #75 (test scaffolding).