[Ayaz-Microsoft]

Purpose

Fix dependabot critical and high vulnerabilities
Critical: 6
High: 11

Update Python dependencies to address Dependabot vulnerabilities across the App, backend, MCP server, and post-provisioning scripts.
• Upgrade Agent Framework to 1.8.1, Claude Agent SDK to 0.2.121, aiohttp to 3.14.4, and Authlib to 1.9.1.
• Pin certifi to 2026.10.18 across services and dnspython to 2.9.0 in the MCP server.
• Refresh lockfiles and raise the MCP server’s minimum Python version from 3.10 to 3.11.

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

• Test the code

What to Check

Verify that the following are valid

• ...

Other Information

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	3835	552	85%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
841	0 💤	0 ❌	0 🔥	9.828s ⏱️

[Copilot]

🔵 Needs a closer look

The framework upgrade affects import-time private-method patches whose compatibility requires real-dependency startup and multi-agent tool-call validation beyond stub-based CI and this source-only review.

No open issues 🎉

What changed in this PR

Updates dependencies across the backend, App, MCP server, and provisioning scripts to address critical and high-severity Dependabot alerts.

Changes:

• Upgrades Agent Framework, Authlib, aiohttp, and certificate-related dependencies.
• Adds explicit dependency pins and refreshes the App and MCP server lockfiles.
• Raises the MCP server’s minimum Python version from 3.10 to 3.11.

File	Description
src/​mcp_server/​uv.lock	Updates resolved dependencies and removes Python 3.10-specific entries.
src/​mcp_server/​pyproject.toml	Upgrades Authlib, pins certifi and dnspython, and requires Python 3.11+.
src/​backend/​pyproject.toml	Upgrades Agent Framework and aiohttp; pins Claude Agent SDK and certifi.
src/​App/​uv.lock	Locks the updated certifi dependency.
src/​App/​requirements.txt	Pins certifi for requirements-based installations.
src/​App/​pyproject.toml	Adds an explicit certifi pin.
infra/​scripts/​post-provision/​requirements.txt	Pins aiohttp for provisioning scripts.

_{Review effort: Balanced}