fix(deps): bump python-multipart to 0.0.32 for VULN-88812

[shuningc]

Summary

• Remediate VULN-88812: path traversal in python-multipart when using UPLOAD_DIR + UPLOAD_KEEP_FILENAME=True (fixed in 0.0.22).
• poetry.lock: python-multipart 0.0.20 → 0.0.32 (transitive; no pyproject change).

Notes

• Vulnerability requires non-default upload config; upgrade still recommended.
• langgraph-fsi-agent/before example remains on 0.0.18 (chainlit caps <0.0.19).

Test plan

• poetry check
• Installed python-multipart 0.0.32; poetry run pytest tests/ (1995 passed, 4 skipped)

Jira

VULN-88812

[etserend]

Code Review — AI-Assisted Feedback

Reviewed by Claude Code (Claude Opus), automated review to assist human reviewers.

Verdict: Approve with comments

Minimal, lock-only security fix. Large version jump spans several API-affecting releases worth documenting.

---

P3 — Large version jump (0.0.20 → 0.0.32) spans API-affecting releases (Claude Code)

File/Section: poetry.lock (python-multipart entry)
Issue: The bump crosses 12 intermediate releases with notable breaking changes: 0.0.23 removed trust_x_headers param and X-File-Name fallback; 0.0.25 removed custom FormParser classes; 0.0.30 changed x-www-form-urlencoded parsing to WHATWG (only & as separator). While python-multipart is transitive-only here (no direct imports found) and constrained under optional extras (openai/all/crewai), these removals are worth calling out for the audit trail.
Evidence: poetry.lock diff version = "0.0.20" → "0.0.32"; python-multipart CHANGELOG entries for 0.0.23 and 0.0.25 list explicit "Remove" changes.
Recommended fix: Non-blocking — no direct usage found in the repo and 1995 tests pass. Consider noting the reviewed API removals in the PR description to strengthen the audit trail. Note: langgraph-fsi-agent/before example intentionally stays on 0.0.18 due to chainlit <0.0.19 cap — acknowledged.

---

P3 — Python floor tightened from >=3.8 to >=3.10 (Claude Code)

File/Section: poetry.lock (python-multipart python-versions field)
Issue: python-multipart 0.0.32 requires Python >=3.10 (up from >=3.8). Eliminates latent support for 3.8/3.9.
Evidence: Diff: -python-versions = ">=3.8" → +python-versions = ">=3.10".
Recommended fix: Confirmed non-blocking — project requires python = "^3.11,<3.15". No action needed.

---

Reviewer	Model	Key Contribution
Claude Code	Claude Opus	Identified API-breaking releases in version jump, Python floor change