fix(security): update dependencies

[BartoszBlizniak]

Description

Resolve security findings by:

• Enforcing patched versions of Cryptography, PyJWT, Pydantic Settings, Starlette, and MCP.
• Updating uv.lock.
• Pinning standalone-binary builder dependencies.
• Replacing Docker ADD instructions with COPY.

No application-code or CLI behaviour changes are included.

Security advisories addressed:

• Cryptography: GHSA-537c-gmf6-5ccf, GHSA-g6cj-pr64-35w5, GHSA-jwv3-5hgf-82ww, GHSA-m2h6-j472-rp4c
• PyJWT: GHSA-993g-76c3-p5m4, GHSA-fhv5-28vv-h8m8, GHSA-jq35-7prp-9v3f, GHSA-w7vc-732c-9m39, GHSA-xgmm-8j9v-c9wx
• MCP: GHSA-vj7q-gjh5-988w
• Pydantic Settings: GHSA-4xgf-cpjx-pc3j
• Starlette: GHSA-82w8-qh3p-5jfq, GHSA-jp82-jpqv-5vv3

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

Unit tests passed on Python 3.10 and 3.14. Package, standalone-binary, Docker, security-scan, and Conda compatibility checks also passed.

[Copilot]

Pull request overview

Updates Python/runtime dependency floors and container build inputs to address multiple security advisories, primarily by ensuring downstream installations cannot resolve vulnerable transitive versions and by hardening Docker build instructions.

Changes:

• Adds explicit runtime dependency “security floors” (cryptography, pydantic-settings, starlette) and raises PyJWT minimum, while pinning MCP to a patched version.
• Regenerates uv.lock to reflect the new constraints and resolved versions.
• Updates the dev Docker build to use COPY instead of ADD and pins the astral/uv builder image by tag+digest.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
uv.lock	Lockfile updated to include new direct dependencies and minimum versions aligned with the security remediation.
pyproject.toml	Adds explicit dependency floors for MCP’s dependency graph and raises PyJWT minimum version.
dev.Dockerfile	Pins the uv builder image and replaces ADD with COPY for safer, more predictable Docker builds.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.