MAINT: Fix dependency alerts

[Roman Lutz (romanlutz)]

Description

GitHub reported 31 Dependabot alerts across Python and frontend dependencies. This consolidates their fixes and also patches the additional high-severity nanoid advisory found during npm audit.

Related PRs: #2928 covers part of the PyJWT remediation, and #2924 covers the nested brace-expansion instance. This change includes those upgrades plus the remaining vulnerable versions and instances; neither existing PR was modified.

Dependency	Previous lock	Updated lock
PyJWT	2.13.0	2.15.1
JupyterLab	4.5.10	4.6.4
Notebook	7.5.6	7.6.3
virtualenv	20.36.1	21.14.5
Tornado	6.5.8	6.5.10
urllib3	2.7.0	2.8.0
brace-expansion, root	5.0.8	5.0.12
brace-expansion, nested	2.1.4	2.1.7
js-yaml	4.3.0	4.3.2
nanoid	3.3.16	3.3.19

Python security floors are raised alongside the targeted lock updates. The published PyJWT runtime minimum becomes 2.15.0. The new virtualenv>=21.7.13 entry is only a uv resolution constraint: pre-commit already brings in virtualenv through [dependency-groups].dev, so this does not add a PyRIT runtime dependency.

Notebook 7.6.3 requires JupyterLab 4.6.4. Required companion changes are limited to the filelock upgrade and the jupyter-builder/python-discovery additions. Frontend updates preserve compatible major versions, unrelated package entries, and platform metadata. No application code or CodeQL configuration is changed.

Tests and Documentation

Validation was completed on Windows with Python 3.14.4, uv 0.11.8, and Node 25.7.0. All 31 recorded GitHub vulnerable ranges, plus the additional nanoid range, are excluded from the updated lockfiles.

Command	Result
uv lock --check --no-progress && uv sync --locked --no-progress	Passed
uv tool run --from uv==0.9.17 uv lock --check --no-progress	Passed with the CI uv version
npm ci --no-fund --no-audit	Passed
npm run lint	Passed
npm run type-check	Passed
npm run test:coverage -- --runInBand	Passed: 99 suites, 2,606 tests, coverage checks
npm audit --json	Passed: zero vulnerabilities, including dev dependencies
git diff --check	Passed

The npm commands above were run from frontend.

Affected Python authentication, networking, HTTP target, and MCP tests: 256 passed with this command from the repository root:

uv sync --locked --extra all --quiet && uv run --locked --extra all -m pytest -q tests\unit\auth\test_manual_copilot_authenticator.py tests\unit\auth\test_copilot_authenticator.py tests\unit\auth\test_browser_session_copilot_authenticator.py tests\unit\common\test_common_net_utility.py tests\unit\prompt_target\target\test_http_target.py tests\unit\prompt_target\target\test_http_api_target.py tests\unit\prompt_target\target\test_http_target_parsing.py tests\unit\prompt_target\target\test_mcp_tool_provider.py

Production build: passed, using the existing PYRIT_PYTHON override because bare python was not available on the local shell's PATH:

$python = uv run --no-sync python -c "import sys; print(sys.executable)"
$env:PYRIT_PYTHON = $python.Trim()
Set-Location frontend
npm run build

Tests/documentation changes: N/A for this dependency-only update. JupyText, the full Python unit suite, Linux/macOS and other Python/Node CI matrix combinations, and live integration/end-to-end tests were not run locally.

[varunj-msft]

lgtm!