fix: Dependent bot vulnerabilities

[Akhileswara-Microsoft]

Purpose

This pull request primarily updates several dependencies across both Python and JavaScript projects to address security, compatibility, and feature improvements. The most significant changes include upgrading python-multipart and cryptography in all Python requirements, updating several key JavaScript packages (including js-yaml, postcss, and nanoid), and restructuring how react-router and related dependencies are managed.

Python dependency upgrades:

• Upgraded python-multipart from 0.0.20 to 0.0.30 in all relevant pyproject.toml and requirements files to ensure consistency and benefit from bug fixes and security updates.
• Upgraded cryptography to 50.0.0 and aiohttp to 3.14.3 where applicable, improving security and compatibility.

JavaScript dependency upgrades:

• Upgraded js-yaml from 4.3.0 to 5.2.2 and updated its binary entry point to bin/js-yaml.mjs, ensuring better support for ES modules.
• Upgraded postcss from 8.5.14 to 8.5.18 and nanoid from 3.3.11 to 3.3.16 for improved performance and bug fixes.

React Router restructuring:

• Updated the way react-router and react-router-dom are included: now using react-router-dom as the main package with its own version of react-router (upgraded to 8.3.0), and replaced the cookie and set-cookie-parser dependencies with cookie-es. This aligns with the latest best practices and dependency requirements for React 19+.

These changes collectively improve security, compatibility, and maintainability across the codebase.

Does this introduce a breaking change?

• Yes
• No

Other Information

This pull request primarily updates several dependencies across the project to address security, compatibility, and feature improvements. The most significant changes involve upgrading Python and JavaScript packages, including python-multipart, cryptography, and core frontend libraries such as react-router, js-yaml, postcss, and related dependencies.

Dependency Upgrades (Python):

• Upgraded python-multipart from 0.0.20 to 0.0.30 in all relevant pyproject.toml files and .github/requirements.txt for improved security and compatibility.
• Upgraded cryptography to 50.0.0 and aiohttp to 3.14.3 to address security and bug fixes in src/backend/pyproject.toml and src/mcp_server/pyproject.toml.

Dependency Upgrades (JavaScript/Frontend):

• Upgraded js-yaml from 4.3.0 to 5.2.2 and updated its binary entry point in both package.json and package-lock.json.
• Upgraded postcss from 8.5.14 to 8.5.18 and nanoid from 3.3.11 to 3.3.16 for improved performance and bug fixes.
• Upgraded routing libraries: replaced direct dependency on react-router with react-router-dom v7.18.1 and added react-router v8.3.0 as a dependency, updating related dependencies such as cookie-es and removing unused dependencies like set-cookie-parser.

These updates ensure the project uses the latest secure and compatible versions of its core dependencies.

Package	Alerts	Count	Applied version	Meets fix?
python-multipart	244, 371, 374, 164, 232, 375, 46, 172, 263, 49, 165, 233, 45, 177, 295, 52, 166, 234, 377, 380, 384	21	0.0.30	✓ (clears <0.0.22 / <0.0.27 / <0.0.30)
cryptography	353, 363, 352, 368, 351	5	50.0.0	✓ (needs 50.0.0)
aiohttp	362, 350	2	3.14.3	✓ (needs 3.14.3)
js-yaml	385	1	5.2.2	✓ (needs ≥4.3.1)
postcss	340	1	8.5.18	✓ (needs 8.5.18)
react-router	332	1	8.3.0	✓ (needs 8.3.0)
Total		31		31/31

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	3824	552	85%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
834	0 💤	0 ❌	0 🔥	9.462s ⏱️

[Copilot]

Pull request overview

This pull request updates Python and JavaScript dependency pins/overrides to remediate reported vulnerability alerts across the backend, MCP server, GitHub CI requirements, and the frontend app.

Changes:

• Bumped Python deps to address security alerts (notably python-multipart==0.0.30, cryptography==50.0.0, aiohttp==3.14.3) across relevant pyproject.toml files and .github/requirements.txt.
• Updated frontend override pins for js-yaml and postcss, and attempted to override/upgrade react-router to 8.3.0.
• Updated package-lock.json to reflect the new JS resolutions (including cookie-es and router-related dependency tree changes).

Reviewed changes

Copilot reviewed 5 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/mcp_server/pyproject.toml	Updates python-multipart and cryptography pins for the MCP server runtime deps.
src/backend/pyproject.toml	Updates backend pins for python-multipart, cryptography, and aiohttp.
src/App/pyproject.toml	Updates python-multipart and adds cryptography pin for the App’s Python deps.
src/App/package.json	Updates overrides (js-yaml/postcss) and adds a react-router override to 8.3.0.
src/App/package-lock.json	Updates resolved packages to match the override changes (js-yaml/postcss/router tree).
.github/requirements.txt	Updates CI/test requirements pin for python-multipart.

Files not reviewed (1)

• src/App/package-lock.json: Generated file

Suppressed comments (1)

src/App/package-lock.json:7523

• react-router@8.3.0 in the lockfile declares engines node>=22.22.0 and peerDependencies react/react-dom>=19.2.7, but src/App/package.json pins react/react-dom to ^18.3.1. This mismatch may break installs in CI or produce runtime issues; either upgrade React/Node to satisfy these constraints or keep router on a compatible major.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.