[PadhiAjit-Microsoft]

Purpose

• This pull request updates several dependencies for both backend (ContentProcessor, ContentProcessorAPI) and frontend (ContentProcessorWeb) components, primarily to keep the codebase secure and up to date. The most significant changes are dependency version bumps, removal of an unused package, and updates to lockfiles to reflect these changes.

Dependency updates (Python):

• Upgraded pymongo from 4.17.0 to 4.18.2 and pyjwt from 2.13.0 to 2.15.0 in src/ContentProcessor/pyproject.toml, src/ContentProcessor/requirements.txt, src/ContentProcessorAPI/pyproject.toml, and src/ContentProcessorAPI/requirements.txt. [1] [2] [3] [4]
• Upgraded urllib3 from 2.7.0 to 2.8.0 in the same files. [1] [2] [3]

Dependency updates (JavaScript/Node):

• Upgraded several frontend dependencies in src/ContentProcessorWeb/package.json and corresponding overrides in pnpm-lock.yaml, including:
  • shell-quote to 1.11.0
  • postcss-selector-parser to 7.1.6
  • brace-expansion to 2.1.7
  • axios to 1.20.0
  • fast-uri to 3.1.8
  • Added proxy-addr (2.0.8), compression (1.8.2), and source-map-js (1.2.2) [1] [2] [3] [4]

Package removal and cleanup:

• Removed node-forge from dependencies and overrides in package.json and pnpm-lock.yaml as it is no longer required. [1] [2]

Lockfile and registry updates:

• Updated pnpm-lock.yaml to reflect new package versions and some registry URLs, ensuring consistency with the new dependency versions. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]

These changes help maintain compatibility, security, and stability across the project’s backend and frontend dependencies.

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	1225	167	86%

report-only-changed-files is enabled. No files were changed during this commit :)

Tests	Skipped	Failures	Errors	Time
244	0 💤	0 ❌	0 🔥	2.586s ⏱️

[Copilot]

🔵 Needs a closer look

Forcing PostCSS selector parser version 6 consumers onto version 7 requires frontend compatibility and build validation.

No open issues 🎉

1 file not reviewed

• src/ContentProcessorWeb/pnpm-lock.yaml: Generated file

What changed in this PR

Updates backend and frontend dependencies to support security and maintenance across the content-processing services.

Changes:

• Upgrades Python dependencies, including PyJWT, PyMongo, and urllib3.
• Updates frontend overrides and lockfile resolutions, including the PostCSS selector parser major-version override.
• Removes the direct node-forge dependency and its override.

File	Description
src/​ContentProcessorWorkflow/​pyproject.toml	Upgrades PyJWT.
src/​ContentProcessorWeb/​pnpm-lock.yaml	Updates resolutions and removes node-forge.
src/​ContentProcessorWeb/​package.json	Updates overrides and removes node-forge.
src/​ContentProcessorAPI/​requirements.txt	Updates pinned Python dependencies.
src/​ContentProcessorAPI/​pyproject.toml	Updates API dependency declarations.
src/​ContentProcessor/​requirements.txt	Updates pinned Python dependencies.
src/​ContentProcessor/​pyproject.toml	Upgrades PyMongo and PyJWT.

_{Review effort: Balanced}