chore: Dev Merge to Main

chore: Dev to Main Merge

…proved quota check fallback logic

…replication

Upgrades security-critical packages across ContentProcessor, ContentProcessorWorkflow, and ContentProcessorWeb modules.

ContentProcessorWorkflow (Python):
- aiohttp: 3.13.5 → 3.14.1 (MEDIUM severity, transitive → direct)
- python-multipart: 0.0.27 → 0.0.31 (HIGH severity)
- cryptography: 46.0.7 → 48.0.1 (HIGH severity)
- pyjwt: 2.12.1 → 2.13.0 (MEDIUM/HIGH severity)
- starlette: 1.0.1 → 1.3.1 (HIGH severity, transitive → direct)

ContentProcessor (Python):
- pyjwt: 2.12.1 → 2.13.0 (MEDIUM/HIGH severity)
- Other vulnerable packages upgraded via transitive dependencies:
  • aiohttp 3.14.1 (via azure-functions-durable)
  • cryptography 48.0.1 (via azure-identity, msal, pyjwt)
  • python-multipart 0.0.31 (via fastapi)
  • starlette 1.3.1 (via fastapi, sse-starlette)

ContentProcessorWeb (NPM):
Direct dependencies:
- axios: 1.15.2 → 1.16.0 (HIGH severity)
- react-router-dom: 7.13.2 → 7.15.1 (HIGH/LOW severity)
- qs: 6.14.2 → 6.15.2 (MEDIUM severity)
- uuid: 11.1.0 → 11.1.1 (MEDIUM severity)
- webpack-dev-server: 5.2.1 → 5.2.4 (MEDIUM severity)

Transitive dependencies (via lock file):
- shell-quote → 1.8.4 (CRITICAL severity)
- form-data → 4.0.6 (HIGH severity)
- ws → 8.21.0 (HIGH severity)
- js-yaml → 4.2.0 (MEDIUM severity)
- launch-editor → 2.14.1 (MEDIUM severity)
- @babel/core → 7.29.6 (LOW severity)

Testing:
- All uv sync operations: PASSED
- ContentProcessorWeb build: PASSED
- No breaking changes
- Verified all secure versions present in lock files

Resolves ~114 security alerts (71% reduction from 161 → ~47).

Note: ContentProcessorAPI excluded per team guidance.

Closes #624
Closes #611
Closes #614

fix: Deployment Failure and pipeline failure for CPAsh

…17-cp

fix: dependabot package upgrades (June 2026)

…nd uv.lock

… 1.9.0

- Change @babel/core override from >=7.29.6 to ^7.29.6 to prevent Babel 8
  which is incompatible with babel-preset-react-app
- Upgrade agent-framework from 1.3.0 to 1.9.0 to satisfy
  agent-framework-orchestrations requiring agent-framework-core>=1.9.0

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…rocessing-solution-accelerator into psl-congen24

….toml

…oml and uv.lock

…r dependencies

chore: remove create-release.yml workflow file

chore: Down merge from main to dev

Replace @Vinay-Microsoft -> @VinaySh-Microsoft and @Prajwal-Microsoft -> @Prajwal1-Microsoft

… uv.lock

…and uv.lock

fix: downgrade agent-framework to version 1.3.0 in pyproject.toml and uv.lock

fix: Add posix in pre-deployment hook in azure.yaml

…ent-cp

fix: remove local deployment related files

refactor: dev to main - Update azure.yaml for GitHub issue URL and add POSIX support

…rfile

chore: Upgrade NGINX base image to version 1.28.3-8-azl3.0.20260722

fix: dev to main merge

chore: main to dev downmerge

# Conflicts:
#	.github/workflows/create-release.yml
#	src/ContentProcessor/requirements.txt
#	src/ContentProcessorAPI/pyproject.toml
#	src/ContentProcessorAPI/requirements.txt
#	src/ContentProcessorAPI/uv.lock

NPM (ContentProcessorWeb pnpm overrides):
- websocket-driver -> ^0.7.5 (CRITICAL, #541)
- axios 1.16.0 -> 1.18.0 (#558)
- brace-expansion ^2.0.3 -> ^2.1.2 (#587)
- fast-uri 3.1.2 -> 3.1.4 (#602/#604)
- immutable ^5.1.5 -> ^5.1.8 (#600/#601)
- js-yaml ^4.2.0 -> ^4.3.0 (#588)
- shell-quote ^1.8.4 -> ^1.9.0 (#589)
- svgo ^2.8.1 -> ^2.8.3 (#603)
- react-router-dom 7.15.1 -> 7.18.1 (#611 DoS)

Python (uv):
- pillow 12.2.0 -> 12.3.0 (ContentProcessor)
- pyasn1 0.6.3 -> 0.6.4 (ContentProcessor, Workflow)
- mcp 1.25.0 -> 1.28.1 (Workflow); transitive mcp -> 1.29.0 (ContentProcessor)

Deferred: react-router #610 (RSC CSRF, fixed only in v8.3.0 major; RSC mode unused by this CRA SPA).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 22668762-66d8-4311-b4c2-ee147376b71d

🔒 - Generated by Copilot

fix: Dependabot critical and high vulnerabilities

fix: dependabot critical and high alerts

…0730