chore(mcp): remediate Dependabot vulns

[undivisible]

Part of #7327.

Failure-Class: none

[Git-on-my-level]

Thanks for the focused dependency remediation. I reviewed the changed MCP dependency files and this looks narrowly scoped: mcp/pyproject.toml only adds direct lower bounds for the packages being remediated, and mcp/uv.lock reflects the corresponding resolved versions (cryptography 49.0.0, pyjwt 2.13.0, python-multipart 0.0.32, starlette 1.3.1) with the mcp-server-omi lock metadata updated consistently.

I’m not formally approving because this touches dependency/lockfile security-sensitive surface and the current check state is not clean enough for an auto-approval path (several relevant repo checks are skipped/cancelled in the rollup). A human maintainer should confirm the Dependabot advisory targets and rerun/verify the applicable MCP/backend dependency checks before merge.

No obvious supply-chain red flags found in the diff itself.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.

[Git-on-my-level]

Dependency-remediation follow-up

This needs maintainer evidence before merge, rather than a blind resolver update:

• Map each new direct lower bound (PyJWT, Starlette, cryptography, python-multipart) to the specific advisory and vulnerable dependency path it resolves.
• Show a clean, reproducible MCP install/lock validation and the relevant MCP/backend test or smoke result on the PR head.
• Keep this separate from fix(backend): remediate Dependabot vulns — 8 dependency bumps #10129: the uv.lock/MCP runtime surface has distinct resolution and release risks from the backend pip dependency wave.

No supply-chain red flag is alleged here; this is an evidence and compatibility gate for direct dependency policy.

[undivisible]

The requested MCP advisory mapping and reproducible MCP validation are not yet recorded on this PR, so it remains open for that dependency-specific evidence.

[kodjima33]

Chore: dependabot vuln remediation (mcp) — approve only per policy

[skanderkaroui]

No test lane covers mcp, so CI skipping everything is expected and the checks passing is not coverage. Suggest running the mcp server once locally against uv.lock before merge as verification evidence.