[prakhar-singh1928]

Pull Request

🔗 Related Issue

Addresses Dependabot security advisories across Python, Node.js, and Rust ecosystems.

---

📝 Summary

Updates Python, Node.js, and Rust dependencies to resolve open security vulnerabilities identified by Dependabot and audit tools (pip-audit, npm audit).

• Python (pyproject.toml, uv.lock):

  • brotli: upgraded 1.2.0 -> 1.2.1 (fixes CVE-2026-4322 / GHSA-9v8h-qqgm-4m35)
  • filelock: upgraded 3.32.7 -> 4.2.4 (fixes CVE-2026-112940, CVE-2026-112913, CVE-2026-112907)
  • setuptools: upgraded 84.0.0 -> 84.2.1 (fixes GHSA-xmj3-9gf7-h52w)
  • virtualenv: upgraded 21.14.6 -> 21.15.0 (fixes CVE-2026-113725, CVE-2026-113722)
  • opentelemetry-api: updated constraint to >=1.45.1

• Node.js (package.json, package-lock.json):

  • vitest / @vitest/coverage-istanbul / @vitest/ui: upgraded 4.0.18 -> 4.1.12 (fixes GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp)
  • dompurify: upgraded 3.4.16 -> 3.4.17 (fixes GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr)
  • retire: upgraded 5.4.2 -> 6.1.0 (resolves transitive zod advisory)
  • overrides: updated undici (^7.30.1), ip-address (>=10.7.4), source-map-js (>=1.2.2)

• Rust (Cargo.toml, crates/mcp_runtime/Cargo.toml, Cargo.lock):

  • opentelemetry_sdk: upgraded 0.31.0 -> 0.32.1
  • opentelemetry: upgraded 0.31.0 -> 0.32.0
  • opentelemetry-otlp: upgraded 0.31.1 -> 0.32.0
  • tracing-opentelemetry: upgraded 0.32.1 -> 0.33.0
  • reqwest: upgraded 0.12.28 -> 0.13.5

---

📏 Reviewability

• This PR has one clear purpose
• The linked issue is not labeled triage
• Unrelated bugs or improvements are tracked in separate issues/PRs
• Tests are included with the code they validate
• If AI-assisted, I understand and can explain the generated changes

---

🏷️ Type of Change

• Bug fix
• Feature / Enhancement
• Documentation
• Refactor
• Chore (deps, CI, tooling)
• Other (describe below)

---

🧪 Verification

Check	Command	Status
Python Security Audit	uv run pip-audit	Passed (0 vulnerabilities)
NPM Security Audit	npm audit	Passed (0 vulnerabilities)
JavaScript Unit Tests	npm test	Passed
UI Build Validation	make build-ui	Passed
Python Lint Suite	make ruff	Passed
Rust Compilation & Tests	cargo check --workspace && cargo test --workspace	Passed (107 unit + 56 integration tests)
Rust Linter & Formatter	cargo clippy -- -D warnings && cargo fmt -- --check	Passed

---

✅ Checklist

• Code formatted (make black isort pre-commit)
• Tests added/updated for changes
• Documentation updated (if applicable)
• No secrets or credentials committed

---

📓 Notes (optional)

All 3 package ecosystems (uv.lock, package-lock.json, and Cargo.lock) are now synchronized with zero open audit findings.

[msureshkumar88]

Approved. The PR delivers what it claims: one dependency-only change across Python, Node.js, and Rust. It touches no application code.

Checked locally on commit ba72518:

• cargo check --workspace --locked and cargo clippy --workspace --locked -- -D warnings pass with OpenTelemetry 0.32 and reqwest 0.13.5.
• cargo test -p contextforge_mcp_runtime --locked passes: 107 unit tests and 2 integration tests.
• uv lock --check and npm ci --dry-run pass. The lockfiles match the manifests.
• test_primary_worker.py and test_bootstrap_db.py pass on filelock 4.2.4. Both create FileLock after fork, so the 3.x fork-safety guard does not apply.

Notes, none blocking:

• Wait for CI before merge. Most jobs were still pending at review time. Watch license-check, dependency-review, and Docker Scan Complete.
• The reqwest feature change from rustls-tls-native-roots to rustls keeps rustls-platform-verifier in the tree. The lockfile already contained it through reqwest-rmcp, so license-check should not change.
• The filelock bump is a major version, 3.x to 4.x. The new filelock>=4.2.1 has no upper bound. Consider a ceiling, as the old pin had.

[gandhipratik203]

LGTM!

[Lang-Akshay]

LGTM ✅