fix: qualify backend JWT and multipart security updates

[jmcentire]

Updates the backend JWT and multipart dependencies and adds executable authentication/parser regression coverage. Also updates FastAPI to 0.136.3 and pins Starlette 1.6.0 because the previous FastAPI pin forced a Starlette version with known vulnerabilities. Application routes and authentication logic are unchanged.

• PyJWT 2.13.0 and python-multipart 0.0.31 cover the security updates proposed by build(deps): bump python-multipart from 0.0.20 to 0.0.31 in /backend #12 and build(deps): bump pyjwt from 2.10.1 to 2.13.0 in /backend #13.
• Seventeen tests exercise actual session authentication, OAuth callback cookies, logout, health/OpenAPI, and framework form parsing without external credentials or services. Centaur has no upload route; multipart checks use an explicitly isolated framework harness.
• Adds Python 3.12/3.13 CI and dependency auditing. The retained root generated test artifacts have eight pre-existing collection errors; backend/tests/README.md documents that separate qualification boundary.

Validation: 17 passed on Python 3.12 and 3.13; four security regressions fail against the original dependency set; pip-audit reports no known vulnerabilities; Ruff and diff checks pass. Database/OAuth collaborators are mocked, so this is not live service or deployment evidence.

Release references: PyJWT 2.13.0, python-multipart 0.0.31, FastAPI 0.136.3.

---

Note

Medium Risk
Dependency major/minor bumps on auth and request-parsing stacks warrant regression coverage; app route logic is unchanged but session validation behavior depends on PyJWT/Starlette versions.

Overview
Bumps backend security-related dependencies and adds CI plus regression tests to qualify the upgrades without changing application auth routes.

backend/requirements.txt moves FastAPI to 0.136.3, explicitly pins Starlette 1.6.0, and updates PyJWT (2.13.0) and python-multipart (0.0.31).

A new GitHub Actions workflow (backend-tests.yml) runs backend/tests on Python 3.12 and 3.13, then pip-audit, only when backend/** changes. backend/tests/README.md documents local runs and clarifies that the maintained suite is separate from broken root tests/ artifacts.

test_security_dependencies.py adds ~17 tests against real /api/auth/*, health, and OpenAPI (mocked DB/OAuth), plus an isolated FastAPI harness for multipart/urlencoded edge cases (JWT invalid cases, bearer vs cookie, OAuth cookie flags, etc.).

^{Reviewed by Cursor Bugbot for commit 2b92ce4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[adaptcom]

Confidence Score: 4/5

Summary

Upgrades backend security dependencies and adds regression coverage with Python 3.12/3.13 CI. No runtime regression was reproduced; two minor documentation and typing issues remain.

Important Files Changed

File	Overview
.github/workflows/backend-tests.yml	Adds Python 3.12/3.13 tests and dependency auditing
backend/requirements.txt	Updates JWT, multipart, FastAPI, and Starlette dependencies
backend/tests/README.md	Documents qualification boundaries but omits CI’s pip-upgrade prerequisite
backend/tests/test_security_dependencies.py	Adds 17 regression cases without required function annotations

↻ Re-run review · View in Adapt

[adaptcom]

Add CI’s pip-upgrade step; these commands fail auditing in fresh Python 3.12.3 environments because bundled pip 24.0 has vulnerabilities unrelated to backend dependencies.

[adaptcom]

Add parameter and return annotations to the new fixtures and test functions, as required by sops.md’s public-function typing standard.