fix(deps): update security-sensitive packages

[sahlbergalfred4-lgtm]

Summary

• update cryptography to 48.0.1, MCP to 1.28.1, Pillow to 12.3.0, pyasn1 to 0.6.4, python-multipart to 0.0.31, and Starlette to 1.3.1
• keep core, extras, lazy-install specifications, and Computer Use expectations synchronized
• regenerate uv.lock from current main

This is a narrow four-file remediation based on current upstream main (8fc2782). It also updates all three stale Computer Use expectations; the older #69892 branch is 22 upstream commits behind and retains the old MCP 1.26.0 failure-path expectation.

Verification

• full suite: 605 passed, 1 skipped, 2 deselected baseline Windows failures
• targeted Computer Use lazy-install tests: 3 passed
• Ruff: passed
• uv lock --check: passed
• uv pip check: 81 packages compatible
• git diff --check: passed
• dependency audit: 81 components, 8 remaining findings, 0 HIGH/CRITICAL
• independent read-only final review: passed with no security concerns or logic errors

No merge or deployment has been performed.

[alt-glitch]

This was generated by AI during triage.

Related to #66871 and #69892: all three refresh the same dependency family, but they differ on package coverage/version policy and regression expectations (including multipart and pyasn1). Marked needs-decision rather than duplicate.

[teknium1]

Thanks for consolidating the dependency refresh and keeping lazy-install coverage in scope.

Problems

• The proposed python-multipart==0.0.31 dashboard pin is now stale. Current main pins 0.0.32 in pyproject.toml:302 and tools/lazy_deps.py:273, and tests/test_packaging_metadata.py:67-74 explicitly guards that floor against update-time downgrades.
• The Computer Use test region has moved substantially: current TestLazyMcpInstall is at tests/tools/test_computer_use.py:762-793, so the former test-line update needs to be reapplied to its current location.

Suggested changes

• Keep the current python-multipart==0.0.32 dashboard pins, then selectively carry the still-unmerged MCP, Pillow, and pyasn1 updates and regenerate uv.lock from the resulting metadata.
• Update the surviving FeatureUnavailable expectation at tests/tools/test_computer_use.py:785 with the selected MCP version.

Automated hermes-sweeper review.

[teknium1]

Current main has since raised the dashboard multipart pin to 0.0.32 (tools/lazy_deps.py:273), and tests/test_packaging_metadata.py:67-74 treats that as the update-downgrade security floor. Retain 0.0.32 when salvaging this refresh rather than lowering it to 0.0.31.

[teknium1]

Thanks @sahlbergalfred4-lgtm — every bump here is now on main: cryptography 48.0.1, Pillow 12.3.0, mcp 1.28.1, starlette 1.3.1, and main's python-multipart has moved past 0.0.31 to 0.0.32. Closing as implemented on main.