fix: dependabot high and critical alert

[Priyanka2-Microsoft]

Purpose

• ...
  This pull request primarily updates dependencies across the Python backend (ContentProcessor, ContentProcessorAPI) and the JavaScript frontend (ContentProcessorWeb). The main focus is on bumping versions for security, compatibility, and bug fixes, as well as cleaning up unused dependencies. No application logic changes are included.

Dependency updates:

Python dependencies:

• Upgraded pymongo from 4.17.0 to 4.18.2 for both pyproject.toml and requirements.txt files, improving MongoDB driver support and security. [1] [2] [3] [4]
• Upgraded pyjwt from 2.13.0 to 2.15.0, addressing security and bug fixes. [1] [2] [3] [4]
• Upgraded urllib3 from 2.7.0 to 2.8.0 for improved HTTP client stability and security. [1] [2] [3]

JavaScript/Frontend dependencies:

• Updated several overrides and direct dependencies, including:
  • shell-quote to 1.11.0, postcss-selector-parser to 7.1.6, brace-expansion to 2.1.7, axios to 1.20.0, and fast-uri to 3.1.8 for bugfixes and compatibility. [1] [2] [3] [4]
  • Added new dependencies: proxy-addr (2.0.8), compression (1.8.2), and source-map-js (1.2.2) to the overrides section for enhanced functionality and compatibility. [1] [2]
• Removed the unused node-forge dependency from package.json and lockfile, cleaning up the project. [1] [2]

Lockfile and registry updates:

• Updated package resolutions in pnpm-lock.yaml to match the new versions and registry URLs for consistency and reliability. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]

These changes ensure the project remains up-to-date with the latest dependency improvements and security patches.

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	1225	167	86%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
244	0 💤	0 ❌	0 🔥	3.650s ⏱️

[Copilot]

🔵 Needs a closer look

It changes security-sensitive dependencies across multiple services, including a forced major frontend upgrade, without recorded golden-path or deployment validation.

0 open findings

What changed in this PR

Updates backend and frontend dependencies to remediate security alerts while keeping manifests and lock data synchronized.

Changes:

• Upgrades PyJWT, PyMongo, and urllib3 across Python services.
• Updates vulnerable frontend transitive dependencies through pnpm overrides.
• Removes the unused node-forge dependency.

File	Description
src/​ContentProcessorWorkflow/​pyproject.toml	Upgrades PyJWT.
src/​ContentProcessorWeb/​package.json	Updates overrides and removes node-forge.
src/​ContentProcessorWeb/​pnpm-lock.yaml	Synchronizes resolved frontend dependencies.
src/​ContentProcessorAPI/​requirements.txt	Updates Python dependency pins.
src/​ContentProcessorAPI/​pyproject.toml	Updates API runtime dependencies.
src/​ContentProcessor/​requirements.txt	Updates processor dependency pins.
src/​ContentProcessor/​pyproject.toml	Updates processor runtime dependencies.

Files not reviewed (1)

• src/ContentProcessorWeb/pnpm-lock.yaml: Generated file

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.