fix(backend): remediate Dependabot vulns — 8 dependency bumps

[undivisible]

Part of #7327, #7145

Result

Bumps 8 packages in backend/requirements.txt to resolve open Dependabot alerts. All 5 platform lockfiles regenerated.

Package	Was	Now	Severity	CVEs/GHSAs resolved
starlette	0.49.1	1.3.1	HIGH	SSRF via UNC paths (Windows), form DoS, Host header bypass, method dispatch
fastapi	0.121.0	0.134.0	—	Cascade for starlette 1.x compat
fastapi-cli	0.0.5	0.0.8	—	Cascade for fastapi 0.134
typer	0.12.3	0.15.4	—	Cascade for fastapi-cli 0.0.8
PyJWT	2.12.0	2.13.0	HIGH	HMAC key confusion token forgery, algorithm bypass, SSRF via PyJWKClient
tornado	6.5.5	6.5.7	HIGH	Auth header leak on cross-origin redirect, gzip bomb
python-multipart	0.0.27	0.0.31	HIGH	Quadratic-time DoS, negative Content-Length, parameter smuggling
cryptography	46.0.7	48.0.1	HIGH	Bundled OpenSSL vulnerability
aiohttp	3.13.4	3.14.1	MED	CRLF injection, cross-origin redirect cookie leak, deserialization

Starlette 0.x → 1.x migration

The biggest change is starlette 0.49→1.3. Direct imports are stable across this boundary:

• starlette.websockets.WebSocketState
• starlette.datastructures.MutableHeaders, UploadFile
• starlette.types.Message, Receive, Scope, Send
• starlette.responses.Response
• starlette.formparsers.MultiPartParser
• starlette.requests.Request

One breaking change found and fixed: TemplateResponse(request, name, context) — starlette 1.x moves request from the context dict to the first positional arg. Fixed in:

• backend/routers/auth.py (2 call sites)
• backend/routers/integrations.py (1 call site)

The custom max_part_size decorator in utils/multipart.py uses starlette.formparsers which is unchanged.

Validation

• Lockfiles regenerated via backend/scripts/update-python-lock.sh (all 5 platforms)
• All pre-push checks pass (manifest, diff-hygiene, architecture, failure-class, typecheck, formatters)

Remaining Dependabot alerts

~400+ alerts remain from plugin requirements.txt files (community sample plugins, not deployed) and stale npm manifests. Those are lower priority and should be addressed separately or dismissed as not-applicable.

Failure-Class: none
Closes: #7327 (partial — backend)
Related: #7145

Product invariants affected

• INV-MEM-1

[Git-on-my-level]

Thanks for taking on the backend security dependency cleanup — the version bumps are pointed at real risky surfaces and the backend CI is green.

I do need to request changes before this is merge-ready: the Starlette/FastAPI templating migration appears incomplete. This PR updates three TemplateResponse call sites to the new TemplateResponse(request, name, context) shape, but there are still old-shape calls that will be exercised under the new Starlette/FastAPI stack:

• backend/routers/task_integrations.py:87 still calls templates.TemplateResponse('oauth_callback.html', context)
• backend/routers/oauth.py:110 still calls templates.TemplateResponse("oauth_authenticate.html", {...})
• backend/routers/mcp_sse.py:1568 still calls templates.TemplateResponse("mcp_oauth_authorize.html", {...})

Please update those remaining template responses (and add/extend a focused test or smoke coverage for these OAuth/MCP/template routes if practical) so the dependency bump does not leave less-traveled auth/integration flows broken.

I did not see signs of a malicious supply-chain change in the patch, and the lockfile entries include pinned hashes from PyPI. Because this is a backend security/dependency PR with a major Starlette boundary, it still needs dependency/security-aware maintainer review after the missed migration call sites are fixed.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.

[undivisible]

Migrated the three remaining TemplateResponse call sites in 452ebc1 and added focused route coverage (12 tests passing).

[kodjima33]

Chore: dependabot vuln remediation (backend, 8 dep bumps) — approve only per policy (backend deps, Nik owns deploy)

[skanderkaroui]

Backend coverage is genuinely green: unit suite, hermetic E2E, both gauntlets, and all image smokes passed, which matters given the starlette 0.x to 1.x jump and the TemplateResponse migration. The Desktop Swift Test Suites failure is stale-branch drift, not this PR: AgentSyncService.startForTesting exists on current main but not on this branch's merge base. The branch also has conflicts with main, so it needs a rebase anyway, which should clear the Swift job too.

[Git-on-my-level]

Thanks for the follow-up fixes. I rechecked the current head (846e548) against the earlier Starlette/FastAPI TemplateResponse blocker, and the previously missed call sites now appear migrated:

• backend/routers/task_integrations.py
• backend/routers/oauth.py
• backend/routers/mcp_sse.py

I also found no remaining old-shape TemplateResponse(...) calls under backend/*.py in a static AST scan, and the backend CI is green. I’m removing needs-tests and dismissing the stale automation change request from the older head because that specific blocker is resolved.

I’m still not formally approving because this remains a backend security/dependency PR across FastAPI/Starlette/PyJWT/cryptography/etc. Please keep the dependency/security review labels until a human maintainer is comfortable with the dependency boundary and release risk.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.

Current head 846e548 resolves the prior TemplateResponse migration blockers identified on 54fad3d; preserving dependency/security human-review labels.