[AAASM-4778] ⬆️ (deps): Remediate mcp/json-repair/semantic-kernel Dependabot alerts

[Chisanan232]

What changed

Remediates the semantic-kernel critical Dependabot alerts (#28, #29) in
python/semantic-kernel-tool-policy/uv.lock by bumping the direct dependency
from >=1.36.0 to >=1.39.4 (resolves to 1.44.0). semantic-kernel >=1.39.4
declares pre-release-only transitive deps (azure-ai-agents>=1.2.0b3,
azure-ai-projects~=1.0.0b12); uv accepts a pre-release only for a direct
requirement carrying a pre-release specifier, so both azure packages are added
as direct deps solely to unlock resolution (the example imports neither). Scoping
the pre-release allowance to exactly those two keeps mcp on stable 1.28.1 —
no beta mcp is dragged in. CI is unaffected (uv sync --extra dev only).

Not fixed here — crewai-research-crew alerts #31/#32/#33/#34 are blocked

The mcp (#32/#33/#34) and json-repair (#31) alerts in
python/crewai-research-crew/uv.lock cannot be remediated by a dependency
bump. Those packages are transitive, pulled in only through the optional live
extra's crewai (never installed in CI). Every published crewai release —
including the latest stable 1.15.3 and all pre-releases — pins
mcp~=1.26.0 (<1.27) and json-repair~=0.25.2 (<0.26). The only versions
available inside those ranges are mcp==1.26.0 and json-repair==0.25.2/0.25.3,
all below the patched mcp>=1.28.1 / json-repair>=0.60.1. No crewai bump
reaches the patched versions. The only ways to force them are (a) crewai upstream
relaxing its pins, or (b) a uv override-dependencies that forces crewai onto
dep versions it declares unsupported — which risks breaking the runnable live
crewai example, so it is deliberately not done here. These four alerts affect
live-extra-only deps that CI never installs; recommend leaving them open pending
a crewai upstream pin relaxation, tracked on AAASM-4778.

Related ticket

Closes AAASM-4778

How to verify

cd python/semantic-kernel-tool-policy
uv sync --extra dev        # resolves; installs semantic-kernel 1.44.0, mcp 1.28.1
uv run pytest tests/ -v    # 6 passed

Checklist

• PR title follows [AAASM-XXXX] <GitEmoji> (<scope>): <summary>
• No secrets, API keys, or .env files committed
• Example sub-projects include their own README.md with prerequisites and run instructions
• SDK/runtime version dependencies are documented or pinned

🤖 Generated with Claude Code

https://claude.ai/code/session_01TdxntF32Wi278LGD22dVS4

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Chisanan232]

Claude Code — PR review

Verdict: ready to approve & merge (pending required Pioneer approval).

Check	Result
CI	✅ green — 26 checks pass (SonarCloud, semantic-kernel-tool-policy verify, metadata drift, Analyze)
Scope vs AAASM-4778	✅ 3 files: SK example pyproject/uv.lock + dependabot.yml
Side effects	✅ none — verify job green, 6/6 tests, only this one example's deps
Front-End	N/A — Python deps + CI config, no FE code → Playwright not applicable

Scope

• semantic-kernel [AAASM-2289] ✅ (ci): Add verify-scenarios.yml CI smoke tests for scenarios #28/[AAASM-2299] ✨ (scenarios): Add policy-enforcement/node/ TypeScript implementation #29 (critical) fixed — semantic-kernel 1.36.0 → 1.44.0 (≥ patched 1.39.4). SK 1.39.4+ pulls pre-release-only transitives (azure-ai-agents>=1.2.0b3, azure-ai-projects>=1.0.0b12); uv only accepts a prerelease when it's a direct requirement, so those two are added as direct deps (with a WHY-comment) purely to unlock resolution — the example imports neither, and scoping it this way keeps mcp on stable 1.28.1.
• dependabot.yml — added mcp/json-repair ignore entries (pip block) for the crewai-pinned, live-only, un-patchable transitives (the 4 dismissed alerts), mirroring e2e-public's AAASM-4768 pattern to stop recurrence.

Side-effect analysis — changes are confined to python/semantic-kernel-tool-policy and the dependabot config. The azure beta deps are required by SK's own tree and never imported by the example (no behavior change); the semantic-kernel-tool-policy verify job (mock/--extra dev path) passed and uv run pytest is 6/6 (baseline also 6). No other example, no shared code, no runtime path altered. mcp deliberately kept on a stable release (no beta mcp 2.0 cascade).

Closes #28/#29 on merge (the mcp/json-repair #31–#34 were separately dismissed as accepted-risk).