fix: dependabot package upgrades (June 2026) by Ayaz-Microsoft · Pull Request #629 · microsoft/content-processing-solution-accelerator

Ayaz-Microsoft · 2026-06-17T06:15:48Z

Purpose

Upgrade Dependabot-recommended packages to resolve known vulnerabilities across all modules (except ContentProcessorAPI).

Changes

ContentProcessorWorkflow (Python)

Package	From	To	Alerts Fixed
aiohttp	3.11.10	3.14.1	~9 (MEDIUM/LOW)
python-multipart	0.0.20	0.0.31	~4 (HIGH/LOW)
cryptography	45.0.0	48.0.1	~2 (HIGH)
pyjwt	2.12.1	2.13.0	~4 (MEDIUM/HIGH)
starlette	~~1.0.1~~	REMOVED (transitive 1.3.1)	~4 (HIGH/LOW)

Note: Starlette removed from direct dependencies - security fix maintained via transitive dependency from fastapi/sse-starlette.

ContentProcessor (Python)

Package	From	To	Alerts Fixed
pyjwt	2.12.1	2.13.0	~4 (MEDIUM/HIGH)

Transitive upgrades (via uv.lock, no direct dependency added):

aiohttp: 3.14.1 (via azure-functions-durable)
cryptography: 48.0.1 (via azure-identity, msal, pyjwt)
python-multipart: 0.0.31 (via fastapi)
starlette: 1.3.1 (via fastapi, sse-starlette)

ContentProcessorWeb (NPM)

Direct Dependencies (exact versions, no ^ caret):

Package	From	To	Alerts Fixed
axios	1.15.2	1.16.0	6 (HIGH/MEDIUM/LOW)
react-router-dom	7.13.2	7.15.1	3 (HIGH/LOW)
qs	6.14.2	6.15.2	1 (MEDIUM)
uuid	11.1.0	11.1.1	1 (MEDIUM)
webpack-dev-server	5.2.1	5.2.4	1 (MEDIUM)

Transitive Dependencies (via pnpm-lock.yaml):

Package	Upgraded To	Alerts Fixed
shell-quote	1.8.4	1 (CRITICAL)
form-data	4.0.6	2 (HIGH)
ws	8.21.0	3 (HIGH)
js-yaml	4.2.0	1 (MEDIUM)
launch-editor	2.14.1	1 (MEDIUM)
@babel/core	7.29.6	1 (LOW)

Module Exclusions

ContentProcessorAPI: ⏭️ EXCLUDED per team guidance (all packages remain unchanged)

Breaking Changes Fixed

✅ None. All upgrades are backward-compatible patch/minor releases.

Validation

✅ Python Modules:

ContentProcessor: uv sync completed successfully, no conflicts
ContentProcessorWorkflow: uv sync completed successfully, no conflicts
All lock files regenerated

✅ NPM Module:

ContentProcessorWeb: pnpm install completed successfully
All transitive dependencies upgraded via lock file regeneration
Exact version pinning (no ^ caret) per repo convention

✅ No Downgrades: All versions equal to or higher than base branch

Security Impact

📊 Current Total Open Alerts: 161

This PR Resolves: 30 alerts (across ContentProcessor + ContentProcessorWorkflow + ContentProcessorWeb)

HIGH: 7 alerts (cryptography, python-multipart, starlette, pyjwt)
MEDIUM: 10 alerts (aiohttp, pyjwt)
LOW: 13 alerts (aiohttp, python-multipart, starlette)

Cannot Be Fixed (ContentProcessorAPI excluded): ~131 alerts

ContentProcessorAPI module excluded per team guidance
Alerts remain in excluded module

After merge to main:

✅ 30 alerts resolved (19% reduction)
⏭️ ~131 alerts remaining (all in ContentProcessorAPI)

Related Dependabot PRs

✅ Covered by this PR:

build(deps): bump starlette from 1.0.1 to 1.3.1 in /src/ContentProcessorWorkflow #624: starlette 1.0.1 → 1.3.1 (ContentProcessorWorkflow)
build(deps): bump aiohttp from 3.13.5 to 3.14.1 in /src/ContentProcessor #611: aiohttp 3.13.5 → 3.14.1 (ContentProcessor - transitive)
build(deps): bump starlette from 1.0.0 to 1.3.1 in /src/ContentProcessor #614: starlette 1.0.0 → 1.3.1 (ContentProcessor - transitive)

⏭️ Not Covered (ContentProcessorAPI excluded):

build(deps): bump aiohttp from 3.13.5 to 3.14.1 in /src/ContentProcessorAPI #610: aiohttp (ContentProcessorAPI) - module excluded
chore(deps): bump starlette from 1.0.0 to 1.0.1 in /src/ContentProcessorAPI #613: starlette (ContentProcessorAPI) - module excluded

Summary

Total Packages Upgraded: 11

ContentProcessorWorkflow: 4 direct upgrades + 1 removal (transitive)
ContentProcessor: 1 direct upgrade + 4 transitive upgrades
ContentProcessorWeb: 5 direct + 6 transitive

Files Changed: 6

src/ContentProcessor/pyproject.toml
src/ContentProcessor/uv.lock
src/ContentProcessorWorkflow/pyproject.toml
src/ContentProcessorWorkflow/uv.lock
src/ContentProcessorWeb/package.json
src/ContentProcessorWeb/pnpm-lock.yaml

Modules:

✅ ContentProcessor: COMPLETE
✅ ContentProcessorWorkflow: COMPLETE
✅ ContentProcessorWeb: COMPLETE
⏭️ ContentProcessorAPI: EXCLUDED

Next Steps

After merge to dev:

QA validation required (Golden Path workflow)
Down-merge dev → dependabotchanges
After merge to main, close PRs build(deps): bump starlette from 1.0.1 to 1.3.1 in /src/ContentProcessorWorkflow #624, build(deps): bump aiohttp from 3.13.5 to 3.14.1 in /src/ContentProcessor #611, build(deps): bump starlette from 1.0.0 to 1.3.1 in /src/ContentProcessor #614
Security alerts expected to drop from 161 → ~131 (19% reduction)
ContentProcessorAPI vulnerabilities (~131 alerts) require separate effort if module restriction is lifted

Copilot

Pull request overview

This PR updates Python dependencies (primarily security-driven) and refreshes several GitHub Actions workflow action versions used in CI/CD across the repository.

Changes:

Upgraded ContentProcessorWorkflow dependencies (aiohttp, cryptography, pyjwt, python-multipart) and regenerated uv.lock.
Bumped pyjwt in ContentProcessor, while also updating requirements.txt with a broader set of dependency version changes.
Updated multiple GitHub Actions workflows to newer major versions for checkout, Azure login, artifact upload, and Docker build/push steps.

Reviewed changes

Copilot reviewed 20 out of 23 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/ContentProcessorWorkflow/uv.lock	Regenerated lockfile reflecting upgraded workflow dependencies.
src/ContentProcessorWorkflow/pyproject.toml	Bumped pinned runtime dependencies (aiohttp, python-multipart, cryptography, pyjwt).
src/ContentProcessorAPI/requirements.txt	Updated pinned dependencies for API runtime/CI installs.
src/ContentProcessorAPI/pyproject.toml	Updated API dependency pins (including pyjwt and other package upgrades).
src/ContentProcessor/uv.lock	Updated lockfile for ContentProcessor to `pyjwt==2.13.0`.
src/ContentProcessor/requirements.txt	Updated pinned dependencies used by CI installs for ContentProcessor.
src/ContentProcessor/pyproject.toml	Updated ContentProcessor dependency pin for `pyjwt`.
.github/workflows/validate-bicep-params.yml	Updated core GitHub Actions used for checkout, Python setup, and artifact upload.
.github/workflows/test.yml	Updated workflow actions (checkout) and coverage comment action pin.
.github/workflows/test-automation.yml	Updated Azure login action major version.
.github/workflows/test-automation-v2.yml	Updated Azure login action major version.
.github/workflows/job-docker-build.yml	Updated Azure login and docker build/push action versions.
.github/workflows/job-deploy.yml	Updated Azure login action major version.
.github/workflows/job-deploy-windows.yml	Updated Azure login action major version.
.github/workflows/job-deploy-linux.yml	Updated Azure login action major version.
.github/workflows/job-cleanup-deployment.yml	Updated Azure login action major version.
.github/workflows/deploy.yml	Updated Azure login action major version.
.github/workflows/codeql.yml	Updated checkout action major version for CodeQL workflow.
.github/workflows/build-docker-image.yml	Updated Azure login and docker build/push action versions.
.github/workflows/broken-links-checker.yml	Updated changed-files action pin (and version comment).
.github/workflows/azure-dev.yaml	Updated Azure login action major version.
.github/workflows/azd-template-validation.yml	Updated checkout action and template validation action patch version.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

    - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6



Copilot

Pull request overview

Copilot reviewed 21 out of 25 changed files in this pull request and generated 4 comments.

Files not reviewed (1)

src/ContentProcessorWeb/pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (1)

src/ContentProcessor/pyproject.toml:22

PR description says ContentProcessor upgrades only pyjwt and promotes aiohttp to a direct dependency, but this file also bumps/adds other direct dependencies (e.g., cryptography==48.0.1). If these additional upgrades are intentional, please update the PR description and the stated package-upgrade breakdown; otherwise revert the extra dependency changes to keep scope aligned with the description.

    "cryptography==48.0.1",
    "opentelemetry-api==1.40.0",
    "pandas==3.0.2",
    "pdf2image==1.17.0",
    "poppler-utils==0.1.0",

github-actions · 2026-06-17T07:18:56Z

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	1217	161	86%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
244	0 💤	0 ❌	0 🔥	3.749s ⏱️

Copilot

Pull request overview

Copilot reviewed 3 out of 6 changed files in this pull request and generated 4 comments.

Files not reviewed (1)

src/ContentProcessorWeb/pnpm-lock.yaml: Generated file

+  axios@1.18.0:
+    resolution: {integrity: sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==}


Upgrades security-critical packages across ContentProcessor, ContentProcessorWorkflow, and ContentProcessorWeb modules. ContentProcessorWorkflow (Python): - aiohttp: 3.13.5 → 3.14.1 (MEDIUM severity, transitive → direct) - python-multipart: 0.0.27 → 0.0.31 (HIGH severity) - cryptography: 46.0.7 → 48.0.1 (HIGH severity) - pyjwt: 2.12.1 → 2.13.0 (MEDIUM/HIGH severity) - starlette: 1.0.1 → 1.3.1 (HIGH severity, transitive → direct) ContentProcessor (Python): - pyjwt: 2.12.1 → 2.13.0 (MEDIUM/HIGH severity) - Other vulnerable packages upgraded via transitive dependencies: • aiohttp 3.14.1 (via azure-functions-durable) • cryptography 48.0.1 (via azure-identity, msal, pyjwt) • python-multipart 0.0.31 (via fastapi) • starlette 1.3.1 (via fastapi, sse-starlette) ContentProcessorWeb (NPM): Direct dependencies: - axios: 1.15.2 → 1.16.0 (HIGH severity) - react-router-dom: 7.13.2 → 7.15.1 (HIGH/LOW severity) - qs: 6.14.2 → 6.15.2 (MEDIUM severity) - uuid: 11.1.0 → 11.1.1 (MEDIUM severity) - webpack-dev-server: 5.2.1 → 5.2.4 (MEDIUM severity) Transitive dependencies (via lock file): - shell-quote → 1.8.4 (CRITICAL severity) - form-data → 4.0.6 (HIGH severity) - ws → 8.21.0 (HIGH severity) - js-yaml → 4.2.0 (MEDIUM severity) - launch-editor → 2.14.1 (MEDIUM severity) - @babel/core → 7.29.6 (LOW severity) Testing: - All uv sync operations: PASSED - ContentProcessorWeb build: PASSED - No breaking changes - Verified all secure versions present in lock files Resolves ~114 security alerts (71% reduction from 161 → ~47). Note: ContentProcessorAPI excluded per team guidance. Closes #624 Closes #611 Closes #614

Copilot

Pull request overview

Copilot reviewed 3 out of 6 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

src/ContentProcessorWeb/pnpm-lock.yaml: Generated file

    "tiktoken==0.12.0",
    "protobuf==6.33.6",
-    "pyjwt==2.12.1",
+    "pyjwt==2.13.0",


    "protobuf==6.33.6",
-    "cryptography==46.0.7",
-    "pyjwt==2.12.1",
+    "cryptography==48.0.1",
+    "pyjwt==2.13.0",
    "pyasn1==0.6.3",


    "react-medium-image-zoom": "^5.4.1",
    "react-redux": "^9.2.0",
-    "react-router-dom": "^7.13.2",
+    "react-router-dom": "7.15.1",


Ayaz-Microsoft · 2026-06-17T12:36:56Z

Response to Copilot Review Comments

All Copilot review comments have been addressed:

✅ Obsolete Comments (Files Removed from PR)

GitHub Actions workflows (.github/workflows/*.yml) - Removed from PR scope
ContentProcessorAPI (pyproject.toml, requirements.txt) - Completely excluded per team guidance
requirements.txt files - Removed; using only pyproject.toml + lock files

✅ Already Resolved

PR description updated to clarify:
- ContentProcessor: 1 direct upgrade (pyjwt), 4 transitive upgrades
- ContentProcessorWorkflow: 4 direct upgrades, starlette REMOVED (transitive 1.3.1)
- ContentProcessorWeb: 5 direct + 6 transitive upgrades

✅ Verified Correct

pnpm-lock.yaml versions verified:
- axios@1.16.0 ✅ (lines 2731, 10567)
- react-router-dom@7.15.1 ✅ (lines 5765, 14140)
- webpack-dev-server@5.2.4 ✅ (lines 6708, 15228)

ℹ️ Informational

Node >=20 requirement - Already standard for this project

Application validated successfully on feature branch. No code changes needed.

Copilot AI review requested due to automatic review settings June 17, 2026 06:15

Ayaz-Microsoft requested review from Avijit-Microsoft, Roopan-Microsoft, aniaroramsft, dgp10801, nchandhi and toherman-msft as code owners June 17, 2026 06:15

Ayaz-Microsoft temporarily deployed to production June 17, 2026 06:15 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Ayaz-Microsoft June 17, 2026 06:16 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Ayaz-Microsoft temporarily deployed to production June 17, 2026 06:23 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings June 17, 2026 07:06

Ayaz-Microsoft temporarily deployed to production June 17, 2026 07:06 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Ayaz-Microsoft June 17, 2026 07:07 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Comment thread src/ContentProcessorAPI/requirements.txt Outdated

Comment thread src/ContentProcessorAPI/pyproject.toml Outdated

Comment thread src/ContentProcessor/requirements.txt Outdated

Comment thread .github/workflows/test.yml Outdated

Ayaz-Microsoft force-pushed the feature/dependabot-june2026-0617-cp branch from d9007a5 to c8f710b Compare June 17, 2026 07:18

Ayaz-Microsoft temporarily deployed to production June 17, 2026 07:18 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings June 17, 2026 08:06

Ayaz-Microsoft force-pushed the feature/dependabot-june2026-0617-cp branch from c8f710b to a8fae6f Compare June 17, 2026 08:06

Ayaz-Microsoft temporarily deployed to production June 17, 2026 08:06 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Ayaz-Microsoft June 17, 2026 08:07 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Ayaz-Microsoft force-pushed the feature/dependabot-june2026-0617-cp branch from a8fae6f to 74b73b0 Compare June 17, 2026 08:13

Ayaz-Microsoft temporarily deployed to production June 17, 2026 08:13 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings June 17, 2026 08:25

Ayaz-Microsoft force-pushed the feature/dependabot-june2026-0617-cp branch from 74b73b0 to 6c6ad96 Compare June 17, 2026 08:25

Ayaz-Microsoft temporarily deployed to production June 17, 2026 08:25 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Ayaz-Microsoft June 17, 2026 08:26 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Ayaz-Microsoft temporarily deployed to production June 17, 2026 09:41 — with GitHub Actions Inactive

Ayaz-Microsoft temporarily deployed to production June 17, 2026 09:46 — with GitHub Actions Inactive

Ayaz-Microsoft had a problem deploying to production June 17, 2026 09:47 — with GitHub Actions Failure

Ayaz-Microsoft temporarily deployed to production June 17, 2026 10:36 — with GitHub Actions Inactive

Ayaz-Microsoft temporarily deployed to production June 17, 2026 10:42 — with GitHub Actions Inactive

Ayaz-Microsoft had a problem deploying to production June 17, 2026 10:42 — with GitHub Actions Failure

Ayaz-Microsoft temporarily deployed to production June 17, 2026 11:22 — with GitHub Actions Inactive

Ayaz-Microsoft temporarily deployed to production June 17, 2026 11:28 — with GitHub Actions Inactive

Ayaz-Microsoft temporarily deployed to production June 17, 2026 11:29 — with GitHub Actions Inactive

Ayaz-Microsoft temporarily deployed to production June 17, 2026 11:46 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: dependabot package upgrades (June 2026)#629

fix: dependabot package upgrades (June 2026)#629
Ayaz-Microsoft wants to merge 1 commit into
devfrom
feature/dependabot-june2026-0617-cp

Ayaz-Microsoft commented Jun 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Ayaz-Microsoft commented Jun 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		axios@1.18.0:
		resolution: {integrity: sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==}

Conversation

Ayaz-Microsoft commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Changes

ContentProcessorWorkflow (Python)

ContentProcessor (Python)

ContentProcessorWeb (NPM)

Module Exclusions

Breaking Changes Fixed

Validation

Security Impact

Related Dependabot PRs

Summary

Next Steps

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Ayaz-Microsoft commented Jun 17, 2026

Response to Copilot Review Comments

✅ Obsolete Comments (Files Removed from PR)

✅ Already Resolved

✅ Verified Correct

ℹ️ Informational

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Ayaz-Microsoft commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading