[prakhar-singh1928]

Pull Request

🔗 Related Issue

Closes #

---

📝 Summary

Routine dependency updates across Python, Rust, Node, and container base images. No functional changes to application logic.

Python: Bumped CPEX exclude-newer timestamps to 2026-09-24 to allow uv lock --upgrade to resolve the latest published versions. Updated uv.lock (70+ packages), docs/requirements.txt, tests/load/requirements.txt, tests/populate/requirements.txt, mcp-servers/python/data_analysis_server/requirements.txt, and all mcp-servers/python/ sub-project lockfiles. Notable upgrades: alembic 1.19→1.20, anyio 4.14→4.15, authlib 1.7→1.8, mcp 1.29→1.30, pydantic 2.13.4→2.13.5, pyjwt 2.13→2.14, ruff 0.16.5→0.16.7, uvicorn 0.52→0.53, and 60+ others.

Rust: cargo update --workspace confirmed all workspace deps are already at the latest Rust 1.85 compatible versions — no Cargo.lock changes. Fixed a pre-existing test flakiness exposed by increased parallelism in the updated tokio: app_state_new_* tests and accepts_sse_event_store_prefix_and_injection_helpers_cover_edge_cases all called AppState::new concurrently with the one test that temporarily removes AUTH_ENCRYPTION_SECRET. Introduced ENV_MUTEX and lock_env_with_auth_secret() to serialise env-var mutation across those tests. All 107 unit tests pass.

Node: npm update refreshed package-lock.json. npm audit reports 0 vulnerabilities. Admin UI bundle rebuilt with make build-ui.

Container images: Updated all ubi10 base image tags across Containerfile, infra/wheels/Containerfile, infra/nginx/Dockerfile, and all five mcp-servers/python/*/Containerfile files.

Image	Old	New
ubi10/ubi	10.1-1770180700 / 10.2-1789459392	10.2-1790075508
ubi10/ubi-minimal	10.1-1770180557 / 10.2-1789456728	10.2-1790075626
ubi10/nodejs-24	10.2-1789345352	10.2-1790228697

---

📏 Reviewability

• This PR has one clear purpose
• The linked issue is not labeled triage
• Unrelated bugs or improvements are tracked in separate issues/PRs
• Tests are included with the code they validate
• If AI-assisted, I understand and can explain the generated changes

---

🏷️ Type of Change

• Chore (deps, CI, tooling)

---

🧪 Verification

Check	Command	Status
Rust build + lint + tests	SDKROOT=.../MacOSX15.4.sdk make rust-check	✅ 107/107 pass
Python lock upgrade	uv lock --upgrade	✅ resolved cleanly
Python reinstall	make install-dev	✅
Vulnerability audit	make pip-audit	✅ 0 CVEs
Rust supply-chain	make rust-vet && cargo vet prune	✅
npm audit	npm audit	✅ 0 vulnerabilities
Admin UI rebuild	make build-ui	✅ built in 4.94s

---

✅ Checklist

• Code formatted (make black isort pre-commit)
• Tests added/updated for changes
• Documentation updated (if applicable)
• No secrets or credentials committed

[prakhar-singh1928]

Closing in favour of a clean branch off the latest main. The rebase picked up partial state from the concurrent mcp sdk v2 merge (#6868) which caused httpx2 import failures. Will re-do from scratch on top of current main.