chore(deps): resolve all open Dependabot security alerts

[sriramveeraghanta]

Closes every open Dependabot alert on this repo (17 alerts, 5 packages) in one resolution, so the lock stays internally consistent rather than landing five separate bumps that each re-resolve against a stale tree.

Package	From	To	Alerts
mcp	1.26.0	1.28.1	GHSA-vj7q-gjh5-988w, GHSA-jpw9-pfvf-9f58, GHSA-hvrp-rf83-w775 (4 alerts, high)
cryptography	48.0.1	50.0.1	GHSA-g6cj-pr64-35w5 (high)
pyjwt	2.12.1	2.14.0	GHSA-xgmm-8j9v-c9wx, GHSA-993g-76c3-p5m4, GHSA-fhv5-28vv-h8m8, GHSA-w7vc-732c-9m39, GHSA-jq35-7prp-9v3f (6 alerts)
python-multipart	0.0.27	0.0.32	GHSA-5rvq-cxj2-64vf, GHSA-v9pg-7xvm-68hf, GHSA-6jv3-5f52-599m, GHSA-vffw-93wf-4j4q (4 alerts)
pydantic-settings	2.12.0	2.15.0	GHSA-4xgf-cpjx-pc3j (medium)

pyproject.toml carries the two versions it states directly — mcp==1.28.1 and PyJWT>=2.13.0. The other three are transitive and move in uv.lock alone. fastmcp stays at 3.2.0 and resolves cleanly against mcp 1.28.1.

The lock diff is exactly these five packages — nothing else moves.

Verification

• pytest tests/ — 1192 passed, 27 skipped on Python 3.11, the runtime the Dockerfile ships.
• Server handshake on the new mcp: a FastMCP.Client tools/list against get_stdio_mcp() returns all 30 tools.
• Note: on Python 3.14, 18 tests fail — plane-sdk method annotations do not evaluate under PEP 649, so SpyClient cannot take their signature. Those same 18 fail identically on main before this change; they are pre-existing and unrelated.

Supersedes

These single-package Dependabot PRs can be closed once this lands: #197 (cryptography), #179 (mcp), #160 (pydantic-settings), #152 (python-multipart), #151 (pyjwt).

Summary by CodeRabbit

• Chores
  • Updated underlying package versions to incorporate the latest compatible improvements and fixes.

[coldtea-pr-lens]

◈ PR Lens

🟢 +0 new · 🟠 ~1 changed · 🔴 -0 removed · 0 flows · 2 files · commit 2d247a2

Architecture

1 component touched across 2 lanes.

Open the interactive canvas

Data flow

No data-flow sequence changed in this PR.

View

• Architecture lens
• Data flow lens
• Expand every detail

Tip

The diagrams are links. Click one to open it on the canvas, then press W or click play to walk through the change.

🪧 More tips

• Run npx skills add coldteadotai/pr-lens, then tell your coding agent: "Diagram the change you just made with PR Lens and attach it to the pull request."
• Run npx @coldtea/pr-lens-cli analyze --base origin/main on a branch, then npx @coldtea/pr-lens-cli render .pr-lens/graph.json. Same lenses, your own model key, before the pull request exists.
• Untick Architecture lens or Data flow lens under View to hide a diagram, or tick Expand every detail to open every section. The comment redraws in a few seconds.
• Click the link under each diagram to open it on a canvas you can zoom, pan and step through.
• Open a diagram on the canvas, then press W or click play to walk through the change one step at a time.
• The CLI's render reads .github/pr-lens.yml and applies your renames, exclusions and lane pins at draw time.
• Set github.comment.collapsed: true in .github/pr-lens.yml to fold the comment behind one View architecture and data flow row. Drawing still runs on every push.
• Add .github/workflows/pr-lens.yml with coldteadotai/pr-lens/packages/action@v0 and your model provider's key as its api-key to run PR Lens from your own CI. Any /chat/completions endpoint works.
• Push a commit and the comment redraws for the new head. A slow older run never overwrites a newer one.
• Switch GitHub to dark mode and the diagrams follow. The moving dots are this pull request's data in motion.

---

Thanks for using PR Lens! It's built by Coldtea, free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: e8e8c290-0514-45eb-9c51-4a5b735233dc

📥 Commits

Reviewing files that changed from the base of the PR and between ae6bad6 and 2d247a2.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• pyproject.toml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The project updates the mcp pin to 1.28.1 and raises the minimum PyJWT version to 2.13.0.

Changes

Dependency Version Updates

Layer / File(s)	Summary
Dependency declarations pyproject.toml	The mcp pin changes from 1.26.0 to 1.28.1. The PyJWT minimum changes from >=2.12.0 to >=2.13.0.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: prashant-surya

Merge Risk: ⚪ Minimal · up to 2d247

The dependency updates have no identified merge-blocking impact.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: dependency updates intended to resolve all open Dependabot security alerts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/security-dependency-bumps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}