fix: dependabot package upgrades (June 2026) by Ayaz-Microsoft · Pull Request #629 · microsoft/content-processing-solution-accelerator · GitHub

Purpose

Upgrade Dependabot-recommended packages to resolve known vulnerabilities across all modules (except ContentProcessorAPI).

Changes

ContentProcessorWorkflow (Python)

Package	From	To	Alerts Fixed
aiohttp	3.11.10	3.14.1	~9 (MEDIUM/LOW)
python-multipart	0.0.20	0.0.31	~4 (HIGH/LOW)
cryptography	45.0.0	48.0.1	~2 (HIGH)
pyjwt	2.12.1	2.13.0	~4 (MEDIUM/HIGH)
starlette	1.0.1	REMOVED (transitive 1.3.1)	~4 (HIGH/LOW)

Note: Starlette removed from direct dependencies - security fix maintained via transitive dependency from fastapi/sse-starlette.

ContentProcessor (Python)

Package	From	To	Alerts Fixed
pyjwt	2.12.1	2.13.0	~4 (MEDIUM/HIGH)

Transitive upgrades (via uv.lock, no direct dependency added):

aiohttp: 3.14.1 (via azure-functions-durable)
cryptography: 48.0.1 (via azure-identity, msal, pyjwt)
python-multipart: 0.0.31 (via fastapi)
starlette: 1.3.1 (via fastapi, sse-starlette)

ContentProcessorWeb (NPM)

Direct Dependencies (exact versions, no ^ caret):

Package	From	To	Alerts Fixed
axios	1.15.2	1.16.0	6 (HIGH/MEDIUM/LOW)
react-router-dom	7.13.2	7.15.1	3 (HIGH/LOW)
qs	6.14.2	6.15.2	1 (MEDIUM)
uuid	11.1.0	11.1.1	1 (MEDIUM)
webpack-dev-server	5.2.1	5.2.4	1 (MEDIUM)

Transitive Dependencies (via pnpm-lock.yaml):

Package	Upgraded To	Alerts Fixed
shell-quote	1.8.4	1 (CRITICAL)
form-data	4.0.6	2 (HIGH)
ws	8.21.0	3 (HIGH)
js-yaml	4.2.0	1 (MEDIUM)
launch-editor	2.14.1	1 (MEDIUM)
@babel/core	7.29.6	1 (LOW)

Module Exclusions

ContentProcessorAPI: ⏭️ EXCLUDED per team guidance (all packages remain unchanged)

Breaking Changes Fixed

✅ None. All upgrades are backward-compatible patch/minor releases.

Validation

✅ Python Modules:

ContentProcessor: uv sync completed successfully, no conflicts
ContentProcessorWorkflow: uv sync completed successfully, no conflicts
All lock files regenerated

✅ NPM Module:

ContentProcessorWeb: pnpm install completed successfully
All transitive dependencies upgraded via lock file regeneration
Exact version pinning (no ^ caret) per repo convention

✅ No Downgrades: All versions equal to or higher than base branch

Security Impact

📊 Current Total Open Alerts: 161

This PR Resolves: 30 alerts (across ContentProcessor + ContentProcessorWorkflow + ContentProcessorWeb)

HIGH: 7 alerts (cryptography, python-multipart, starlette, pyjwt)
MEDIUM: 10 alerts (aiohttp, pyjwt)
LOW: 13 alerts (aiohttp, python-multipart, starlette)

Cannot Be Fixed (ContentProcessorAPI excluded): ~131 alerts

ContentProcessorAPI module excluded per team guidance
Alerts remain in excluded module

After merge to main:

✅ 30 alerts resolved (19% reduction)
⏭️ ~131 alerts remaining (all in ContentProcessorAPI)

Related Dependabot PRs

✅ Covered by this PR:

build(deps): bump starlette from 1.0.1 to 1.3.1 in /src/ContentProcessorWorkflow #624: starlette 1.0.1 → 1.3.1 (ContentProcessorWorkflow)
build(deps): bump aiohttp from 3.13.5 to 3.14.1 in /src/ContentProcessor #611: aiohttp 3.13.5 → 3.14.1 (ContentProcessor - transitive)
build(deps): bump starlette from 1.0.0 to 1.3.1 in /src/ContentProcessor #614: starlette 1.0.0 → 1.3.1 (ContentProcessor - transitive)

⏭️ Not Covered (ContentProcessorAPI excluded):

build(deps): bump aiohttp from 3.13.5 to 3.14.1 in /src/ContentProcessorAPI #610: aiohttp (ContentProcessorAPI) - module excluded
chore(deps): bump starlette from 1.0.0 to 1.0.1 in /src/ContentProcessorAPI #613: starlette (ContentProcessorAPI) - module excluded

Summary

Total Packages Upgraded: 11

ContentProcessorWorkflow: 4 direct upgrades + 1 removal (transitive)
ContentProcessor: 1 direct upgrade + 4 transitive upgrades
ContentProcessorWeb: 5 direct + 6 transitive

Files Changed: 6

src/ContentProcessor/pyproject.toml
src/ContentProcessor/uv.lock
src/ContentProcessorWorkflow/pyproject.toml
src/ContentProcessorWorkflow/uv.lock
src/ContentProcessorWeb/package.json
src/ContentProcessorWeb/pnpm-lock.yaml

Modules:

✅ ContentProcessor: COMPLETE
✅ ContentProcessorWorkflow: COMPLETE
✅ ContentProcessorWeb: COMPLETE
⏭️ ContentProcessorAPI: EXCLUDED

Next Steps

After merge to dev:

QA validation required (Golden Path workflow)
Down-merge dev → dependabotchanges
After merge to main, close PRs build(deps): bump starlette from 1.0.1 to 1.3.1 in /src/ContentProcessorWorkflow #624, build(deps): bump aiohttp from 3.13.5 to 3.14.1 in /src/ContentProcessor #611, build(deps): bump starlette from 1.0.0 to 1.3.1 in /src/ContentProcessor #614
Security alerts expected to drop from 161 → ~131 (19% reduction)
ContentProcessorAPI vulnerabilities (~131 alerts) require separate effort if module restriction is lifted

Pull request overview

This PR updates Python dependencies (primarily security-driven) and refreshes several GitHub Actions workflow action versions used in CI/CD across the repository.

Changes:

Upgraded ContentProcessorWorkflow dependencies (aiohttp, cryptography, pyjwt, python-multipart) and regenerated uv.lock.
Bumped pyjwt in ContentProcessor, while also updating requirements.txt with a broader set of dependency version changes.
Updated multiple GitHub Actions workflows to newer major versions for checkout, Azure login, artifact upload, and Docker build/push steps.

Reviewed changes

Copilot reviewed 20 out of 23 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/ContentProcessorWorkflow/uv.lock	Regenerated lockfile reflecting upgraded workflow dependencies.
src/ContentProcessorWorkflow/pyproject.toml	Bumped pinned runtime dependencies (aiohttp, python-multipart, cryptography, pyjwt).
src/ContentProcessorAPI/requirements.txt	Updated pinned dependencies for API runtime/CI installs.
src/ContentProcessorAPI/pyproject.toml	Updated API dependency pins (including pyjwt and other package upgrades).
src/ContentProcessor/uv.lock	Updated lockfile for ContentProcessor to pyjwt==2.13.0.
src/ContentProcessor/requirements.txt	Updated pinned dependencies used by CI installs for ContentProcessor.
src/ContentProcessor/pyproject.toml	Updated ContentProcessor dependency pin for pyjwt.
.github/workflows/validate-bicep-params.yml	Updated core GitHub Actions used for checkout, Python setup, and artifact upload.
.github/workflows/test.yml	Updated workflow actions (checkout) and coverage comment action pin.
.github/workflows/test-automation.yml	Updated Azure login action major version.
.github/workflows/test-automation-v2.yml	Updated Azure login action major version.
.github/workflows/job-docker-build.yml	Updated Azure login and docker build/push action versions.
.github/workflows/job-deploy.yml	Updated Azure login action major version.
.github/workflows/job-deploy-windows.yml	Updated Azure login action major version.
.github/workflows/job-deploy-linux.yml	Updated Azure login action major version.
.github/workflows/job-cleanup-deployment.yml	Updated Azure login action major version.
.github/workflows/deploy.yml	Updated Azure login action major version.
.github/workflows/codeql.yml	Updated checkout action major version for CodeQL workflow.
.github/workflows/build-docker-image.yml	Updated Azure login and docker build/push action versions.
.github/workflows/broken-links-checker.yml	Updated changed-files action pin (and version comment).
.github/workflows/azure-dev.yaml	Updated Azure login action major version.
.github/workflows/azd-template-validation.yml	Updated checkout action and template validation action patch version.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Pull request overview

Copilot reviewed 21 out of 25 changed files in this pull request and generated 4 comments.

Files not reviewed (1)

src/ContentProcessorWeb/pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (1)

src/ContentProcessor/pyproject.toml:22

PR description says ContentProcessor upgrades only pyjwt and promotes aiohttp to a direct dependency, but this file also bumps/adds other direct dependencies (e.g., cryptography==48.0.1). If these additional upgrades are intentional, please update the PR description and the stated package-upgrade breakdown; otherwise revert the extra dependency changes to keep scope aligned with the description.

    "cryptography==48.0.1",
    "opentelemetry-api==1.40.0",
    "pandas==3.0.2",
    "pdf2image==1.17.0",
    "poppler-utils==0.1.0",

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	1217	161	86%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
244	0 💤	0 ❌	0 🔥	3.749s ⏱️

Pull request overview

Copilot reviewed 3 out of 6 changed files in this pull request and generated 4 comments.

Files not reviewed (1)

src/ContentProcessorWeb/pnpm-lock.yaml: Generated file

Upgrades security-critical packages across ContentProcessor, ContentProcessorWorkflow, and ContentProcessorWeb modules. ContentProcessorWorkflow (Python): - aiohttp: 3.13.5 → 3.14.1 (MEDIUM severity, transitive → direct) - python-multipart: 0.0.27 → 0.0.31 (HIGH severity) - cryptography: 46.0.7 → 48.0.1 (HIGH severity) - pyjwt: 2.12.1 → 2.13.0 (MEDIUM/HIGH severity) - starlette: 1.0.1 → 1.3.1 (HIGH severity, transitive → direct) ContentProcessor (Python): - pyjwt: 2.12.1 → 2.13.0 (MEDIUM/HIGH severity) - Other vulnerable packages upgraded via transitive dependencies: • aiohttp 3.14.1 (via azure-functions-durable) • cryptography 48.0.1 (via azure-identity, msal, pyjwt) • python-multipart 0.0.31 (via fastapi) • starlette 1.3.1 (via fastapi, sse-starlette) ContentProcessorWeb (NPM): Direct dependencies: - axios: 1.15.2 → 1.16.0 (HIGH severity) - react-router-dom: 7.13.2 → 7.15.1 (HIGH/LOW severity) - qs: 6.14.2 → 6.15.2 (MEDIUM severity) - uuid: 11.1.0 → 11.1.1 (MEDIUM severity) - webpack-dev-server: 5.2.1 → 5.2.4 (MEDIUM severity) Transitive dependencies (via lock file): - shell-quote → 1.8.4 (CRITICAL severity) - form-data → 4.0.6 (HIGH severity) - ws → 8.21.0 (HIGH severity) - js-yaml → 4.2.0 (MEDIUM severity) - launch-editor → 2.14.1 (MEDIUM severity) - @babel/core → 7.29.6 (LOW severity) Testing: - All uv sync operations: PASSED - ContentProcessorWeb build: PASSED - No breaking changes - Verified all secure versions present in lock files Resolves ~114 security alerts (71% reduction from 161 → ~47). Note: ContentProcessorAPI excluded per team guidance. Closes #624 Closes #611 Closes #614

Pull request overview

Copilot reviewed 3 out of 6 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

src/ContentProcessorWeb/pnpm-lock.yaml: Generated file

Response to Copilot Review Comments

All Copilot review comments have been addressed:

✅ Obsolete Comments (Files Removed from PR)

GitHub Actions workflows (.github/workflows/*.yml) - Removed from PR scope
ContentProcessorAPI (pyproject.toml, requirements.txt) - Completely excluded per team guidance
requirements.txt files - Removed; using only pyproject.toml + lock files

✅ Already Resolved

PR description updated to clarify:
- ContentProcessor: 1 direct upgrade (pyjwt), 4 transitive upgrades
- ContentProcessorWorkflow: 4 direct upgrades, starlette REMOVED (transitive 1.3.1)
- ContentProcessorWeb: 5 direct + 6 transitive upgrades

✅ Verified Correct

pnpm-lock.yaml versions verified:
- axios@1.16.0 ✅ (lines 2731, 10567)
- react-router-dom@7.15.1 ✅ (lines 5765, 14140)
- webpack-dev-server@5.2.4 ✅ (lines 6708, 15228)

ℹ️ Informational

Node >=20 requirement - Already standard for this project

Application validated successfully on feature branch. No code changes needed.

Copilot AI review requested due to automatic review settings June 17, 2026 06:15

Ayaz-Microsoft requested review from Avijit-Microsoft, Roopan-Microsoft, Anish Arora (aniaroramsft), dgp10801, nchandhi and Todd Herman (toherman-msft) as code owners June 17, 2026 06:15

Ayaz-Microsoft temporarily deployed to production June 17, 2026 06:15 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Ayaz-Microsoft June 17, 2026 06:16 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Ayaz-Microsoft temporarily deployed to production June 17, 2026 06:23 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings June 17, 2026 07:06

Ayaz-Microsoft temporarily deployed to production June 17, 2026 07:06 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Ayaz-Microsoft June 17, 2026 07:07 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Comment thread src/ContentProcessorAPI/requirements.txt Outdated

Comment thread src/ContentProcessorAPI/pyproject.toml Outdated

Comment thread src/ContentProcessor/requirements.txt Outdated

Comment thread .github/workflows/test.yml Outdated

Ayaz-Microsoft force-pushed the feature/dependabot-june2026-0617-cp branch from d9007a5 to c8f710b Compare June 17, 2026 07:18

Ayaz-Microsoft temporarily deployed to production June 17, 2026 07:18 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings June 17, 2026 08:06

Ayaz-Microsoft force-pushed the feature/dependabot-june2026-0617-cp branch from c8f710b to a8fae6f Compare June 17, 2026 08:06

Ayaz-Microsoft temporarily deployed to production June 17, 2026 08:06 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Ayaz-Microsoft June 17, 2026 08:07 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Comment thread src/ContentProcessor/pyproject.toml

Comment thread src/ContentProcessorWeb/pnpm-lock.yaml Outdated

Comment thread src/ContentProcessorWeb/pnpm-lock.yaml Outdated

Comment thread src/ContentProcessorWeb/pnpm-lock.yaml Outdated

Ayaz-Microsoft force-pushed the feature/dependabot-june2026-0617-cp branch from a8fae6f to 74b73b0 Compare June 17, 2026 08:13

Ayaz-Microsoft temporarily deployed to production June 17, 2026 08:13 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings June 17, 2026 08:25

Ayaz-Microsoft force-pushed the feature/dependabot-june2026-0617-cp branch from 74b73b0 to 6c6ad96 Compare June 17, 2026 08:25

Ayaz-Microsoft temporarily deployed to production June 17, 2026 08:25 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Ayaz-Microsoft June 17, 2026 08:26 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Comment thread src/ContentProcessor/pyproject.toml

Comment thread src/ContentProcessorWorkflow/pyproject.toml

Comment thread src/ContentProcessorWeb/package.json

Ayaz-Microsoft temporarily deployed to production June 17, 2026 09:41 — with GitHub Actions Inactive

Ayaz-Microsoft temporarily deployed to production June 17, 2026 09:46 — with GitHub Actions Inactive

Ayaz-Microsoft had a problem deploying to production June 17, 2026 09:47 — with GitHub Actions Failure

Ayaz-Microsoft temporarily deployed to production June 17, 2026 10:36 — with GitHub Actions Inactive

Ayaz-Microsoft temporarily deployed to production June 17, 2026 10:42 — with GitHub Actions Inactive

Ayaz-Microsoft had a problem deploying to production June 17, 2026 10:42 — with GitHub Actions Failure

Ayaz-Microsoft temporarily deployed to production June 17, 2026 11:22 — with GitHub Actions Inactive

Ayaz-Microsoft temporarily deployed to production June 17, 2026 11:28 — with GitHub Actions Inactive

Ayaz-Microsoft temporarily deployed to production June 17, 2026 11:29 — with GitHub Actions Inactive

Ayaz-Microsoft temporarily deployed to production June 17, 2026 11:46 — with GitHub Actions Inactive

Roopan-Microsoft approved these changes Jun 17, 2026

View reviewed changes

Roopan-Microsoft approved these changes Jun 18, 2026

View reviewed changes

Roopan-Microsoft merged commit e978828 into dev Jun 18, 2026
31 of 33 checks passed

fix: dependabot package upgrades (June 2026) by Ayaz-Microsoft · Pull Request #629 · microsoft/content-processing-solution-accelerator · GitHub

fix: dependabot package upgrades (June 2026) - #629

Conversation

Ayaz-Microsoft commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Changes

ContentProcessorWorkflow (Python)

ContentProcessor (Python)

ContentProcessorWeb (NPM)

Module Exclusions

Breaking Changes Fixed

Validation

Security Impact

Related Dependabot PRs

Summary

Next Steps

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Ayaz-Microsoft commented Jun 17, 2026

Response to Copilot Review Comments

✅ Obsolete Comments (Files Removed from PR)

✅ Already Resolved

✅ Verified Correct

ℹ️ Informational

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Ayaz-Microsoft commented Jun 17, 2026 •
edited
Loading

github-actions Bot commented Jun 17, 2026 •
edited
Loading