fix: remediate audited dependency vulnerabilities

[SabrinaTso]

Summary

• Update direct runtime dependency pins to versions with no known pip-audit advisories.
• Upgrade FastMCP from 2.13.1 to 3.2.0, remove the obsolete v2 experimental parser flag, and retain the existing stateless streamable-HTTP composition.
• Add a lifespan-backed MCP initialize regression test so the mounted /mcp transport is verified in addition to individual tool functions.
• Exclude local virtual environments, test/coverage artifacts, and .env / .env.* files from the Docker build context.

Verification — CPython 3.14.7

• Fresh Python 3.14.7 virtual environment installed requirements-tests.txt and requirements-dev.txt; pip check passed.
• python -m pip_audit -r requirements.txt --timeout 5 --progress-spinner off — no known vulnerabilities.
• python -m compileall -q src tests.
• python -m pytest -q — 680 passed on CPython 3.14.7.
• pre-commit run --all-files — Black and isort passed.
• docker build --pull using python:3.14-slim — final build context: 18.23 kB.
• Non-root container smoke test: a real JSON-RPC initialize request to /mcp returned HTTP 200 and the expected NTHU Campus Assistant identity; the temporary container was stopped and auto-removed.

Security review

• Staged-diff secret scan, named-file staging review, D: drive path check, and git diff --check.
• Final Codex Security diff audit for 8a363b9..f9e451c — complete coverage, 0 findings.

CI note

GitHub's upstream Test and Lint with pre-commit workflows are currently action_required for this fork PR and have not run. A maintainer must approve their execution; this PR does not represent them as passing CI.

Scope

This is intentionally an independent dependency-security PR. It does not change the academic-calendar design in #184, PR #255, or the separate CORS test-first PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[SabrinaTso]

Hi @l7wei — could you approve the fork workflow runs for this PR when convenient? The upstream Test and Lint with pre-commit workflows are both action_required, so they have not executed.

This is intentionally an independent, reviewable dependency-security PR: remediation of known dependency advisories, FastMCP v3 compatibility cleanup, MCP initialize regression coverage, and Docker build-context exclusions. It does not change the academic-calendar work in #184 / #255 or the composed-app/CORS decision in #254.

The PR description records the CPython 3.14.7 test run (680 passed), a python:3.14-slim container /mcp smoke test, and the completed security diff audit. Approving the workflows would only start CI; it is not approval to merge.

If the project prefers a different dependency-upgrade or review workflow, a brief direction is enough. Thanks.

[Copilot]

Pull request overview

This pull request remediates audited dependency vulnerabilities, upgrades FastMCP, adds MCP initialization coverage, and tightens Docker build exclusions.

Changes:

• Updates dependency pins.
• Removes obsolete FastMCP configuration.
• Adds mounted /mcp initialization regression coverage.
• Expands .dockerignore exclusions.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Summary
tests/test_mcp_tools.py	Adds mounted MCP initialization testing.
src/data_api/core/settings.py	Removes obsolete FastMCP configuration.
requirements.txt	Updates dependency pins.
.dockerignore	Excludes environments, secrets, and development artifacts.

Suppressed comments (1)

.dockerignore:13

• The documented test command writes its HTML report to coverage/ and its XML report to coverage.xml (README.md:84-87 and both CI workflows), but neither path is ignored here. Because the Dockerfile uses COPY . ., running the tests before docker build will send these artifacts in the build context, so the stated context reduction is not reliable; add both coverage paths.

htmlcov/

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.