Fix 10 backend CVEs by updating dependencies

Direct bumps:
- fastapi 0.135.3 → 0.136.0
- python-multipart 0.0.22 → 0.0.26 (CVE-2026-24486, CVE-2026-40347)
- pytest 8.3.4 → 9.0.3 (CVE-2025-71176)
- pytest-asyncio 0.25.0 → 1.3.0 (for pytest 9 compat)

New transitive pins:
- starlette>=0.49.1 (CVE-2025-54121, CVE-2025-62727)
- pdfminer.six>=20251230 (CVE-2025-64512, CVE-2025-70559)
- pillow>=12.2.0 (CVE-2026-40192)
- cryptography>=46.0.7 (CVE-2026-39892)

pip-audit now reports only 1 remaining CVE (transformers CVE-2026-1839,
no non-RC fix available yet; kept in ignore list).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: kutcode

.github/workflows/ci.yml

@@ -36,7 +36,7 @@ jobs:
       - name: Run backend tests
         run: pytest
       - name: Security scan with pip-audit
-        run: pip install pip-audit==2.10.0 && pip-audit --ignore-vuln CVE-2025-71176 --ignore-vuln CVE-2026-1839
+        run: pip install pip-audit==2.10.0 && pip-audit --ignore-vuln CVE-2026-1839
 
   frontend:
     runs-on: ubuntu-latest

backend/requirements-dev.txt

@@ -1,8 +1,8 @@
 # Development / testing dependencies
 -r requirements.txt
 
-pytest==8.3.4
-pytest-asyncio==0.25.0
+pytest==9.0.3
+pytest-asyncio==1.3.0
 httpx==0.28.1
 ruff==0.15.9
 pip-audit==2.10.0

backend/requirements.txt

@@ -1,7 +1,8 @@
 # Web framework
-fastapi==0.135.3
+fastapi==0.136.0
 uvicorn[standard]==0.34.0
-python-multipart==0.0.22
+python-multipart==0.0.26
+starlette>=0.49.1
 
 # Database
 sqlalchemy==2.0.36
@@ -13,6 +14,8 @@ greenlet==3.2.5
 # Document parsing
 python-docx==1.1.2
 pdfplumber==0.11.9
+pdfminer.six>=20251230
+pillow>=12.2.0
 openpyxl>=3.1.0
 
 # AI / Embeddings
@@ -29,3 +32,4 @@ alembic==1.14.1
 
 # Authentication
 PyJWT[crypto]==2.12.0
+cryptography>=46.0.7