[P0] Remediate backend dependency vulnerabilities with compatibility coverage

[fxbin]

Parent: #2

Problem

The security job on current main fails pip-audit. This blocks a trusted baseline and indicates the pinned dependency set is stale relative to known advisories.

Evidence

Actions run 31603354158 reported 69 vulnerability findings across 7 resolved packages. Observed affected packages include authlib, cryptography, pypdf, python-multipart, and starlette (the latter may be transitive through FastAPI).

Current direct pins include FastAPI 0.115.6, Authlib 1.3.2, cryptography 44.0.0, pypdf 5.1.0 and python-multipart 0.0.20.

WorkOrder

Worker: Backend / Security
Verifier: independent Backend/QA verifier

Scope

1. Capture the complete pip-audit package/advisory/fixed-version matrix from a clean environment.
2. Classify each finding: direct vs transitive, reachable vs non-reachable, upgrade path and compatibility risk.
3. Upgrade in the smallest compatible groups; avoid a blind all-at-once dependency bump.
4. Add/execute focused regression coverage for authentication/OAuth, multipart uploads, PDF ingestion, HTTP/TLS paths and FastAPI/Starlette request handling.
5. Re-run full backend tests, migration checks and security job.
6. Document any accepted exception with advisory ID, rationale, expiry/revisit trigger and owner; do not simply suppress globally.

Acceptance criteria

• Clean pip-audit passes, or every residual finding has an explicit narrowly-scoped, time-bounded disposition reviewed by Verifier.
• Authentication/OAuth smoke tests pass.
• File upload/PDF ingestion smoke tests pass.
• API request/response compatibility tests pass after FastAPI/Starlette changes.
• Migration and backend regression suites pass.
• PR documents dependency deltas and rollback strategy.

Risks

Major/minor dependency jumps can introduce behavioral changes in ASGI middleware, crypto/token handling and parsers. Split upgrades when compatibility evidence is weak.

Rollback

Keep each dependency group in a revertible commit/PR slice where practical; no schema migration should be bundled into this issue.

[fxbin]

Verified security baseline from CI run 31603354158

pip-audit reported 69 findings across 7 resolved packages on Python 3.12.13.

Package	Resolved version	Highest observed minimum fix needed from current advisory set	Classification
authlib	1.3.2	1.6.12	direct/runtime, OAuth/auth-sensitive
cryptography	44.0.0	50.0.0	direct/runtime, crypto-sensitive
pypdf	5.9.0	6.15.0	direct/runtime; current requirement constrains <6.0, therefore major-version migration required
python-multipart	0.0.20	0.0.31	direct/runtime, upload/form-sensitive
starlette	0.41.3	advisory set includes fixes above current FastAPI constraint	transitive/runtime through FastAPI; requires framework compatibility work
python-dotenv	1.0.1	1.2.2	direct/runtime/config
pytest	8.3.4	9.0.3	dev/test tooling

Important compatibility observations

1. FastAPI/Starlette cannot be treated as a simple transitive bump. Current FastAPI 0.115.6 resolves starlette<0.42.0,>=0.40.0, while the current audit includes Starlette advisories whose fixes require newer releases. Upgrade them as one compatibility slice.
2. pypdf requires an intentional major-version migration. Current requirement is pypdf<6.0,>=4.0, but the audit requires pypdf 6.x fixes (up through 6.15.0 in this run).
3. Authlib + cryptography need auth regression coverage, not blind pin replacement.
4. The security job fails before npm audit, so frontend audit status is currently unknown, not green.

I am splitting runtime-sensitive remediation into bounded child WorkOrders. No blanket pip install -U approach.

[fxbin]

Child WorkOrders created

• [P0][Security] Upgrade FastAPI/Starlette + python-multipart as one compatibility slice #10 — FastAPI / Starlette / python-multipart compatibility slice
• [P0][Security] Upgrade Authlib + cryptography with OAuth/session regression coverage #11 — Authlib / cryptography auth-sensitive slice
• [P0][Security] Migrate pypdf 5.x → secure 6.x with ingestion regression tests #12 — pypdf 5.x → secure 6.x migration
• [P1][Security] Upgrade python-dotenv/pytest and make security scan report backend + frontend independently #13 — python-dotenv / pytest + independent backend/frontend security reporting

Execution branches are prepared from current main:

• issue-10-secure-fastapi-starlette-multipart
• issue-11-secure-authlib-cryptography
• issue-12-pypdf-v6-security-migration
• issue-13-security-scan-observability

These can run in parallel because they have distinct primary dependency/verification surfaces. Any shared conflict in requirements*.txt must be resolved at integration time with a fresh full resolver + full CI run; do not mechanically merge dependency pins.

[fxbin]

Security baseline refined by #16 diagnostic proof

Frontend security is now independently verified: npm ci audited 414 packages and npm audit --audit-level=high reported 0 vulnerabilities.

The security gate remains red solely because backend pip-audit reports the known 69 findings across 7 packages. Child WorkOrders #10, #11, #12, and #13 therefore remain the remediation path; no speculative frontend dependency upgrade is needed from this baseline.