fix: dependabot package upgrade

[Dhruvkumar-Microsoft]

Purpose

This pull request primarily updates dependencies and GitHub Actions workflows to use newer, more secure, and maintained versions. The changes improve compatibility, security, and stability across the project’s Python, Node.js, and CI/CD environments.

Dependency Updates

• Updated Python dependencies in src/backend/pyproject.toml, src/backend/requirements.txt, src/App/pyproject.toml, and src/mcp_server/pyproject.toml to the latest compatible versions, including major packages like fastapi, uvicorn, azure-*, openai, protobuf, and others. This enhances security, performance, and feature support. [1] [2] [3] [4] [5]
• Updated postcss dependency in src/App/package-lock.json to version 8.5.14 for improved security and bug fixes.

GitHub Actions Workflow Updates

• Upgraded actions/checkout to v6 and other GitHub Actions (such as setup-python, upload-artifact, template-validation-action, and changed-files) to their latest versions in various workflow files for improved performance and security. [1] [2] [3] [4] [5]
• Updated azure/login action from v2 to v3 across all workflows to ensure compatibility with the latest Azure authentication mechanisms. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]

These updates collectively modernize the project, reduce technical debt, and ensure a more reliable development and deployment pipeline.

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

• Test the code

What to Check

Verify that the following are valid

• ...

Other Information

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	3034	379	87%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
883	5 💤	0 ❌	0 🔥	7.947s ⏱️

[Copilot]

Pull request overview

This pull request modernizes the project’s dependency set (Python + Node) and CI/CD workflows to newer versions, aiming to improve security and long-term maintainability across the backend, App service, MCP server, and GitHub Actions pipelines.

Changes:

• Upgraded multiple Python dependencies (and regenerated uv.lock files) for src/backend, src/mcp_server, and src/App.
• Updated backend dependency pinning in both pyproject.toml and requirements.txt to keep them aligned.
• Updated GitHub Actions workflow action versions (e.g., actions/checkout, actions/setup-python, actions/upload-artifact, azure/login) and bumped postcss in the frontend lockfile.

Reviewed changes

Copilot reviewed 17 out of 21 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/mcp_server/uv.lock	Lockfile refresh to reflect updated MCP server dependency versions.
src/mcp_server/pyproject.toml	Bumps MCP server deps (e.g., python-dotenv, python-multipart).
src/backend/uv.lock	Lockfile refresh for backend dependency upgrades (FastAPI/OpenAI/Azure/OTel stack, etc.).
src/backend/requirements.txt	Aligns pip requirements with upgraded backend dependency pins.
src/backend/pyproject.toml	Updates backend dependency pins (and dev extras) for newer versions.
src/App/uv.lock	Updates App Python lockfile to match newly pinned env/multipart packages.
src/App/pyproject.toml	Pins python-dotenv / python-multipart to specific versions for the App package.
src/App/package-lock.json	Upgrades postcss to 8.5.14 in the Node lockfile.
.github/workflows/validate-bicep-params.yml	Updates core Actions versions (checkout/setup-python/upload-artifact).
.github/workflows/test-automation-v2.yml	Updates azure/login to v3.
.github/workflows/job-docker-build.yml	Updates azure/login to v3.
.github/workflows/job-deploy.yml	Updates azure/login to v3.
.github/workflows/job-deploy-windows.yml	Updates azure/login to v3.
.github/workflows/job-deploy-linux.yml	Updates azure/login to v3.
.github/workflows/job-cleanup-deployment.yml	Updates azure/login to v3.
.github/workflows/docker-build-and-push.yml	Updates azure/login to v3.
.github/workflows/deploy.yml	Updates azure/login to v3 in deploy + follow-up job.
.github/workflows/deploy-waf.yml	Updates azure/login to v3.
.github/workflows/broken-links-checker.yml	Updates pinned tj-actions/changed-files commit to newer version.
.github/workflows/azure-dev.yml	Updates checkout and azure/login action versions.
.github/workflows/azd-template-validation.yml	Updates checkout and template validation action version.

Files not reviewed (1)

• src/App/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 21 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• src/App/package-lock.json: Language not supported

[github-actions]

🎉 This PR is included in version 4.2.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀