fix(deps): bump python-multipart to 0.0.32 for VULN-88812

[shuningc]

Summary

Fixes VULN-88812 by upgrading transitive python-multipart to 0.0.32 via poetry.lock regeneration.

Lock-only change — no direct python-multipart import or pyproject.toml floor.

Approach

python-multipart is transitive, installed under optional extras (openai, all, crewai) — primarily via mcp. No direct usage of python-multipart APIs in this repo; multipart file uploads use httpx/OpenAPI client to_multipart() helpers.

API review (0.0.20 → 0.0.32)

Reviewed intermediate releases for audit trail. Notable removals (no impact found in this repo):

Version	Change
0.0.23	Removed trust_x_headers param and X-File-Name fallback
0.0.25	Removed custom FormParser classes
0.0.30	x-www-form-urlencoded parsing follows WHATWG (& only as separator)

Full test suite passes (~1995 tests). No direct import python_multipart in codebase.

Python version note

python-multipart 0.0.32 requires Python ≥3.10 (was ≥3.8). Non-blocking — project requires python = "^3.11,<3.15".

Example lock exception

langgraph-fsi-agent/before/poetry.lock intentionally remains on 0.0.18 due to chainlit's <0.0.19 cap — acknowledged, out of main package scope.

Vulnerability

• Ticket: VULN-88812
• Package: python-multipart
• Fixed in: 0.0.32

Test plan

• CI passes
• No direct python-multipart usage in repo
• Optional extras (openai/all/crewai) still resolve

[etserend]

Code Review — AI-Assisted Feedback

Reviewed by Claude Code (Claude Opus), automated review to assist human reviewers.

Verdict: Approve with comments

Minimal, lock-only security fix. Large version jump spans several API-affecting releases worth documenting.

---

P3 — Large version jump (0.0.20 → 0.0.32) spans API-affecting releases (Claude Code)

File/Section: poetry.lock (python-multipart entry)
Issue: The bump crosses 12 intermediate releases with notable breaking changes: 0.0.23 removed trust_x_headers param and X-File-Name fallback; 0.0.25 removed custom FormParser classes; 0.0.30 changed x-www-form-urlencoded parsing to WHATWG (only & as separator). While python-multipart is transitive-only here (no direct imports found) and constrained under optional extras (openai/all/crewai), these removals are worth calling out for the audit trail.
Evidence: poetry.lock diff version = "0.0.20" → "0.0.32"; python-multipart CHANGELOG entries for 0.0.23 and 0.0.25 list explicit "Remove" changes.
Recommended fix: Non-blocking — no direct usage found in the repo and 1995 tests pass. Consider noting the reviewed API removals in the PR description to strengthen the audit trail. Note: langgraph-fsi-agent/before example intentionally stays on 0.0.18 due to chainlit <0.0.19 cap — acknowledged.

---

P3 — Python floor tightened from >=3.8 to >=3.10 (Claude Code)

File/Section: poetry.lock (python-multipart python-versions field)
Issue: python-multipart 0.0.32 requires Python >=3.10 (up from >=3.8). Eliminates latent support for 3.8/3.9.
Evidence: Diff: -python-versions = ">=3.8" → +python-versions = ">=3.10".
Recommended fix: Confirmed non-blocking — project requires python = "^3.11,<3.15". No action needed.

---

Reviewer	Model	Key Contribution
Claude Code	Claude Opus	Identified API-breaking releases in version jump, Python floor change