fix: resolve remaining Python Dependabot alerts

[kalil0321]

Summary

• update the six vulnerable Python packages through uv and regenerate uv.lock
  • cryptography 48.0.0 → 49.0.0
  • mcp 1.26.0 → 1.28.1
  • PyJWT 2.12.1 → 2.13.0
  • python-multipart 0.0.27 → 0.0.32
  • SoupSieve 2.8.3 → 2.9.1
  • Starlette 0.52.1 → 1.3.1
• group future security-only Dependabot updates for Python, the website, Cursor Bridge, and GitHub Actions
• add CI coverage for the Python suite, the static website, and Cursor Bridge

Why

The remaining ten alerts are all high severity, but most require server or parsing paths the current trusted-user CLI does not expose: Starlette form/static serving, MCP HTTP/WebSocket/auth sessions, mixed-algorithm JWT verification, or attacker-controlled SoupSieve selectors. The bundled OpenSSL issue in cryptography remains directly relevant because outbound network peers are outside the trusted local environment. Updating all packages is still cheap defense in depth and prevents these paths becoming reachable later.

Dependabot automatic security fixes are currently disabled at repository level. This configuration is ready to group security PRs once that setting is enabled; routine version-update PRs remain disabled to avoid noise.

Verification

• GitHub CI: Python, Website, and Cursor Bridge jobs passed
• CodeQL JavaScript/TypeScript and Python analyses passed
• uv run --offline --frozen pytest -q — 866 passed
• pnpm run lint — passed
• npm ci --offline — 0 vulnerabilities
• node --check run.mjs — passed
• YAML syntax and git diff --check — passed

The local macOS website build could not load Next's downloaded SWC binary because the OS rejected its code signature; the clean Linux Website CI job passed the type check, lint, and production build.

Greptile Summary

This change refreshes vulnerable Python dependencies, adds automated dependency-update configuration, and introduces CI checks for the Python package, website, and Cursor Bridge. The Python test workflow was verified against the package metadata and tests only Python 3.13 even though the package supports Python 3.11 through 3.13. Compatibility regressions affecting Python 3.11 or 3.12 can therefore reach users without CI coverage, so this should be addressed before merge.

Confidence Score: 3/5

Not safe to merge until T-Rex findings are addressed.

The workflow’s Python selector was checked against package metadata and confirmed to omit Python 3.11 and 3.12, allowing version-specific regressions to ship to supported users.

T-Rex reproduced 2 failing behaviors at runtime in .github/workflows/ci.yml; the change needs fixes before it is safe to merge.

Files Needing Attention: .github/workflows/ci.yml needs a Python-version matrix or separate test jobs for Python 3.11, 3.12, and 3.13.

T-Rex Logs

What T-Rex did

• T-Rex produced a consolidated proof confirming the P1 finding and linked it to the review comment.
• T-Rex validated Python CI coverage with a general-contract-validation-proof, including before-state and after-state evidence and noting incomplete coverage.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

1. General comment

   Python CI omits supported 3.11 and 3.12

   • Bug
     • The newly added Python job invokes pytest only after setup-uv installs Python 3.13. Package metadata declares requires-python = ">=3.11" and explicitly classifies 3.11, 3.12, and 3.13; therefore regressions that affect only 3.11 or 3.12 can merge without this CI job executing them.
   • Cause
     • .github/workflows/ci.yml uses the single literal python-version: "3.13" rather than testing the supported minor versions through a matrix or separate jobs.
   • Fix
     • Use a Python-version matrix containing at least 3.11, 3.12, and 3.13 for dependency installation and pytest, or narrow the published support metadata if those versions are intentionally unsupported.

   _{Ran code and verified through T-Rex}

Prompt To Fix All With AI

### Issue 1
.github/workflows/ci.yml:23
**Python CI omits supported 3.11 and 3.12**

The package declares support for Python 3.11 and later, including 3.11, 3.12, and 3.13 classifiers, but this job installs and tests only Python 3.13. A dependency, syntax, or runtime regression specific to 3.11 or 3.12 can therefore merge without being exercised, despite those interpreters being supported for users. Run the test job through a matrix covering at least Python 3.11, 3.12, and 3.13, or narrow the published support range.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix: update Python security dependencies..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[kalil0321]

@greptile review

[greptile-apps]

Python CI omits supported 3.11 and 3.12

The package declares support for Python 3.11 and later, including 3.11, 3.12, and 3.13 classifiers, but this job installs and tests only Python 3.13. A dependency, syntax, or runtime regression specific to 3.11 or 3.12 can therefore merge without being exercised, despite those interpreters being supported for users. Run the test job through a matrix covering at least Python 3.11, 3.12, and 3.13, or narrow the published support range.

Artifacts

Python CI compatibility coverage validation source

• The executable validator reads package metadata and workflow version selectors from a requested Git revision and fails when a supported minor version is not selected by CI.

Python CI coverage before PR workflow was introduced

• Executed against origin/main, the validator shows metadata supports Python 3.11 through 3.13 but no CI workflow existed before the PR.

Python CI coverage after PR workflow was introduced

• Executed against HEAD, the validator shows CI selects only 3.13 and misses supported 3.11 and 3.12, confirming the coverage gap.

_{Ran code and verified through T-Rex}

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/ci.yml
Line: 23

Comment:
**Python CI omits supported 3.11 and 3.12**

The package declares support for Python 3.11 and later, including 3.11, 3.12, and 3.13 classifiers, but this job installs and tests only Python 3.13. A dependency, syntax, or runtime regression specific to 3.11 or 3.12 can therefore merge without being exercised, despite those interpreters being supported for users. Run the test job through a matrix covering at least Python 3.11, 3.12, and 3.13, or narrow the published support range.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.