chore: upgrade vulnerable packages (Python + NPM)

Upgrades security-critical packages across ContentProcessor, ContentProcessorWorkflow, and ContentProcessorWeb modules.

ContentProcessorWorkflow (Python):
- aiohttp: 3.13.5 → 3.14.1 (MEDIUM severity, transitive → direct)
- python-multipart: 0.0.27 → 0.0.31 (HIGH severity)
- cryptography: 46.0.7 → 48.0.1 (HIGH severity)
- pyjwt: 2.12.1 → 2.13.0 (MEDIUM/HIGH severity)
- starlette: 1.0.1 → 1.3.1 (HIGH severity, transitive → direct)

ContentProcessor (Python):
- pyjwt: 2.12.1 → 2.13.0 (MEDIUM/HIGH severity)
- Other vulnerable packages upgraded via transitive dependencies:
  • aiohttp 3.14.1 (via azure-functions-durable)
  • cryptography 48.0.1 (via azure-identity, msal, pyjwt)
  • python-multipart 0.0.31 (via fastapi)
  • starlette 1.3.1 (via fastapi, sse-starlette)

ContentProcessorWeb (NPM):
Direct dependencies:
- axios: 1.15.2 → 1.16.0 (HIGH severity)
- react-router-dom: 7.13.2 → 7.15.1 (HIGH/LOW severity)
- qs: 6.14.2 → 6.15.2 (MEDIUM severity)
- uuid: 11.1.0 → 11.1.1 (MEDIUM severity)
- webpack-dev-server: 5.2.1 → 5.2.4 (MEDIUM severity)

Transitive dependencies (via lock file):
- shell-quote → 1.8.4 (CRITICAL severity)
- form-data → 4.0.6 (HIGH severity)
- ws → 8.21.0 (HIGH severity)
- js-yaml → 4.2.0 (MEDIUM severity)
- launch-editor → 2.14.1 (MEDIUM severity)
- @babel/core → 7.29.6 (LOW severity)

Testing:
- All uv sync operations: PASSED
- ContentProcessorWeb build: PASSED
- No breaking changes
- Verified all secure versions present in lock files

Resolves ~114 security alerts (71% reduction from 161 → ~47).

Note: ContentProcessorAPI excluded per team guidance.

Closes #624
Closes #611
Closes #614

Author: Ayaz-Microsoft

src/ContentProcessor/pyproject.toml

@@ -24,7 +24,7 @@ dependencies = [
     "python-dotenv==1.2.2",
     "tiktoken==0.12.0",
     "protobuf==6.33.6",
-    "pyjwt==2.12.1",
+    "pyjwt==2.13.0",
     "pyasn1==0.6.3",
 ]
 

src/ContentProcessor/uv.lock

@@ -24,7 +24,7 @@
     "react-i18next": "^16.5.4",
     "react-medium-image-zoom": "^5.4.1",
     "react-redux": "^9.2.0",
-    "react-router-dom": "^7.13.2",
+    "react-router-dom": "7.15.1",
     "react-scripts": "^5.0.1",
     "react-toastify": "^11.0.5",
     "react-virtualized": "^9.22.6",
@@ -109,20 +109,20 @@
       "lodash": "^4.17.24",
       "path-to-regexp": "^0.1.13",
       "picomatch": "^2.3.2",
-      "qs": "^6.14.2",
+      "qs": "6.15.2",
       "rollup": "^2.80.0",
       "serialize-javascript": "^7.0.5",
       "underscore": "^1.13.8",
-      "webpack-dev-server": "^5.2.1",
+      "webpack-dev-server": "5.2.4",
       "yaml": "^2.0.0",
       "svgo": "^2.8.1",
       "jsonpath": "^1.3.0",
       "follow-redirects": "^1.16.0",
-      "axios": "1.15.2",
+      "axios": "1.16.0",
       "fast-uri": "3.1.2",
       "@babel/plugin-transform-modules-systemjs": "7.29.4",
       "@ungap/structured-clone": "1.3.1",
-      "uuid": "11.1.0"
+      "uuid": "11.1.1"
     },
     "onlyBuiltDependencies": [
       "@parcel/watcher",

src/ContentProcessorWeb/package.json

@@ -6,7 +6,7 @@ readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
     "agent-framework==1.3.0",
-    "aiohttp==3.13.5",
+    "aiohttp==3.14.1",
     "art==6.5",
     "azure-ai-agents==1.2.0b5",
     "azure-ai-inference==1.0.0b9",
@@ -24,15 +24,15 @@ dependencies = [
     "mcp==1.25.0",
     "openai==2.15.0",
     "psutil==7.2.1",
-    "python-multipart==0.0.27",
+    "python-multipart==0.0.31",
     "pytz==2025.2",
     "sas-cosmosdb==0.1.4",
     "sas-storage==1.0.0",
     "tenacity==9.1.2",
     "authlib==1.6.12",
     "protobuf==6.33.6",
-    "cryptography==46.0.7",
-    "pyjwt==2.12.1",
+    "cryptography==48.0.1",
+    "pyjwt==2.13.0",
     "pyasn1==0.6.3",
 ]