From 1aacb6740b20dd4dd55d43a0d97a385f5ca279b0 Mon Sep 17 00:00:00 2001
From: raymondginger <raymondginger2018@gmail.com>
Date: Sat, 24 Oct 2026 18:49:37 +0800
Subject: [PATCH] build(desktop): take the patched aiohttp, certifi, mcp, pypdf
 and setuptools

The scheduled dependency audit has reported "Dependency audit failed on
main" in #252 twice since the npm half was fixed in 3d40e250, so the
sidecar venv audit job is the remaining red step. Reproducing it locally
with the CI-pinned pip-audit 2.10.1 found 22 known vulnerabilities in 5
packages of desktop/sidecar-requirements.lock:

- aiohttp 3.14.3 -> 3.14.4 (8 advisories)
- certifi 2026.6.17 -> 2026.10.23 (1 advisory)
- mcp 1.29.0 -> 1.30.0 (1 advisory; the advisory also lists 2.2.0 but
  staying on the 1.x line keeps the diff inside the existing mcp>=1.29,<2
  range declared in requirements.txt)
- pypdf 6.19.0 -> 6.21.2 (11 advisories)
- setuptools 83.0.0 -> 84.2.1 (1 advisory)

Only the three direct pins in sidecar-requirements.in moved. The lock was
regenerated with the documented command plus --upgrade-package for the two
transitive packages, so yarl rides along as aiohttp's own dependency and
nothing else changes.

Verification: uv pip compile resolves cleanly, the rebuilt sidecar venv
installs all 66 components, and desktop/scripts/audit-python-environment.py
now reports "No known vulnerabilities found" instead of raising
CalledProcessError. The test surfaces that touch the moved packages pass
under mcp 1.30.0 and pypdf 6.21.2: 9 passed in tests/test_mcp_server.py and
tests/test_mcp_oauth.py, 13 passed in tests/test_pdf_utils.py and
tests/test_document_conversion.py.
---
 desktop/sidecar-requirements.in   |  6 +++---
 desktop/sidecar-requirements.lock | 12 ++++++------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/desktop/sidecar-requirements.in b/desktop/sidecar-requirements.in
index 7a64a043..7ffb5eab 100644
--- a/desktop/sidecar-requirements.in
+++ b/desktop/sidecar-requirements.in
@@ -2,17 +2,17 @@
 # and Paper2Code kernels. Keep this list narrower than the CLI development
 # environment so packaging is reproducible and does not inherit local tools.
 aiofiles==25.1.0
-aiohttp==3.14.3
+aiohttp==3.14.4
 anthropic==0.116.0
 httpx==0.28.1
 json-repair==0.61.4
 loguru==0.7.3
-mcp==1.29.0
+mcp==1.30.0
 openai==2.29.0
 prompt-toolkit==3.0.52
 pydantic==2.12.5
 pydantic-settings==2.14.2
-pypdf==6.19.0
+pypdf==6.21.2
 PyYAML==6.0.3
 tiktoken==0.12.0
 
diff --git a/desktop/sidecar-requirements.lock b/desktop/sidecar-requirements.lock
index 67f0fc88..4a6098ba 100644
--- a/desktop/sidecar-requirements.lock
+++ b/desktop/sidecar-requirements.lock
@@ -4,7 +4,7 @@ aiofiles==25.1.0
     # via -r sidecar-requirements.in
 aiohappyeyeballs==2.7.1
     # via aiohttp
-aiohttp==3.14.3
+aiohttp==3.14.4
     # via -r sidecar-requirements.in
 aiosignal==1.4.0
     # via aiohttp
@@ -29,7 +29,7 @@ attrs==26.1.0
     #   aiohttp
     #   jsonschema
     #   referencing
-certifi==2026.6.17
+certifi==2026.10.23
     # via
     #   httpcore
     #   httpx
@@ -91,7 +91,7 @@ loguru==0.7.3
     # via -r sidecar-requirements.in
 macholib==1.16.4 ; sys_platform == 'darwin'
     # via pyinstaller
-mcp==1.29.0
+mcp==1.30.0
     # via -r sidecar-requirements.in
 multidict==6.9.1
     # via
@@ -136,7 +136,7 @@ pyinstaller-hooks-contrib==2026.6
     #   pyinstaller
 pyjwt==2.15.1
     # via mcp
-pypdf==6.19.0
+pypdf==6.21.2
     # via -r sidecar-requirements.in
 python-dotenv==1.2.2
     # via pydantic-settings
@@ -160,7 +160,7 @@ rpds-py==2026.6.3
     # via
     #   jsonschema
     #   referencing
-setuptools==83.0.0
+setuptools==84.2.1
     # via pyinstaller
 sniffio==1.3.1
     # via
@@ -202,5 +202,5 @@ wcwidth==0.8.2
     # via prompt-toolkit
 win32-setctime==1.2.0 ; sys_platform == 'win32'
     # via loguru
-yarl==1.24.2
+yarl==1.25.1
     # via aiohttp