fix: dev to main Dependent bot vulnerabilities fix

[Akhileswara-Microsoft]

Purpose

This pull request updates several dependencies across multiple components of the project to address security, compatibility, and feature improvements. The most notable changes are version bumps for python-multipart and cryptography in both backend and server components, as well as updates to frontend dependencies and the addition of new packages.

Dependency updates for Python components:

• Upgraded python-multipart from version 0.0.20 to 0.0.30 in .github/requirements.txt, src/App/pyproject.toml, src/backend/pyproject.toml, and src/mcp_server/pyproject.toml to address security and compatibility issues.
• Updated cryptography from 48.0.1 to 50.0.0 in src/backend/pyproject.toml and src/mcp_server/pyproject.toml for improved security and bug fixes. * Upgraded aiohttp from 3.13.5 to 3.14.3 in src/backend/pyproject.toml for enhanced stability and features.

Frontend dependency updates:

• Updated js-yaml from 4.3.0 to 5.2.2 in src/App/package.json to address security vulnerabilities and improve YAML parsing.
• Added postcss version 8.5.18 as a new dependency in src/App/package.json to support CSS processing.

Other dependency additions:

• Added cryptography==50.0.0 to the dependencies in src/App/pyproject.toml for cryptographic functions.## Does this introduce a breaking change?

• Yes
• No

Other Information

Package	Alerts	Count	Applied version	Meets fix?
python-multipart	244, 371, 374, 164, 232, 375, 46, 172, 263, 49, 165, 233, 45, 177, 295, 52, 166, 234, 377, 380, 384	21	0.0.30	✓ (clears <0.0.22 / <0.0.27 / <0.0.30)
cryptography	353, 363, 352, 368, 351	5	50.0.0	✓ (needs 50.0.0)
aiohttp	362, 350	2	3.14.3	✓ (needs 3.14.3)
js-yaml	385	1	5.2.2	✓ (needs ≥4.3.1)
postcss	340	1	8.5.18	✓ (needs 8.5.18)
react-router	332	1	not fixed	✓ (needs 8.3.0)
Total		31		30/31

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	3824	552	85%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
834	0 💤	0 ❌	0 🔥	10.425s ⏱️

[Copilot]

Pull request overview

This pull request updates pinned dependency versions across the backend, MCP server, CI Python requirements, and the frontend app to address security/compatibility issues and keep versions consistent across components.

Changes:

• Bump python-multipart to 0.0.30 across .github/requirements.txt, src/App/pyproject.toml, src/backend/pyproject.toml, and src/mcp_server/pyproject.toml.
• Bump cryptography to 50.0.0 in backend and MCP server (and add an explicit pin in src/App/pyproject.toml).
• Update frontend package.json overrides for js-yaml and add an override for postcss.

Reviewed changes

Copilot reviewed 5 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/mcp_server/pyproject.toml	Updates python-multipart and cryptography pins for the MCP server runtime.
src/backend/pyproject.toml	Updates python-multipart, cryptography, and aiohttp pins for backend runtime.
src/App/pyproject.toml	Updates python-multipart and adds explicit cryptography pin for the frontend’s Python service.
src/App/package.json	Updates/adds overrides entries to force patched transitive JS package versions.
.github/requirements.txt	Updates CI/test dependency pin for python-multipart.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.