Bump vulnerable dependencies: aiohttp, cryptography, fastapi, python-multipart, next.js

[Copilot]

Multiple direct dependencies carried known CVEs across DoS, ReDoS, authorization bypass, SSRF, arbitrary file write, and cryptographic subgroup-attack vectors.

Python (backend/requirements.txt)

Package	Old	New	CVEs addressed
fastapi	0.109.0	0.109.1	Content-Type Header ReDoS
cryptography	42.0.2	46.0.5	NULL pointer deref (≥38,<42.0.4); SECT curve subgroup attack (≤46.0.4)
python-multipart	0.0.6	0.0.22	ReDoS (≤0.0.6); malformed boundary DoS (<0.0.18); arbitrary file write (<0.0.22)
aiohttp	3.9.3	3.13.3	Malformed POST DoS (<3.9.4); zip-bomb via auto_decompress (≤3.13.2)

JavaScript (frontend/package.json)

Package	Old	New	CVEs addressed
next	14.1.0	15.2.9	Authorization bypass (middleware); SSRF in Server Actions; cache poisoning; Server Components DoS (multiple variants)
eslint-config-next	14.1.0	15.2.9	Aligned with Next.js version

Next.js 14.x has no backport for the HTTP request deserialization DoS (≥13.0.0, <15.0.8), making the 15.x upgrade necessary. The application is largely client-rendered ('use client' throughout), so Next.js 15's async-request-API breaking changes have no impact here.

Original prompt

You are a senior full-stack architect and AI systems engineer.

Your task is to design and implement a production-ready AI scheduling agent application.

====================================================
GOAL

Build an application where:

1. A user talks to an AI agent (Smallest.ai Atom agent).
2. The user says they want to schedule a call.
3. The agent:
   • Extracts intent
   • Extracts participants
   • Extracts duration
   • Asks clarifying questions
4. The agent checks availability of BOTH participants via Google Calendar API.
5. The agent negotiates possible times conversationally.
6. Once a time is agreed:
   • The system creates a Google Calendar event
   • Sends invite to both users
   • Includes Google Meet link
   • Confirms scheduling

This must be production-grade SaaS architecture, not a demo.

====================================================
TECH STACK REQUIREMENTS

Backend:

• Python
• FastAPI
• Google API Python Client
• OAuth2
• PostgreSQL
• SQLAlchemy
• Pydantic

Frontend:

• Next.js
• TypeScript
• TailwindCSS
• Chat-style interface

AI:

• Smallest.ai Atom Agent
• Tool-calling architecture
• Structured JSON function calls

Deployment:

• Docker
• Docker Compose
• Environment variable-based secret handling

====================================================
SECURITY RULES

• Never hardcode secrets.
• All secrets must come from environment variables.
• Assume credentials JSON files are stored locally and referenced securely.
• Encrypt OAuth tokens before storing in database.
• Implement token refresh logic.
• Use secure cookies.
• Implement CSRF protection.
• Configure CORS properly.
• Assume HTTPS in production.

Environment variables to use:

GOOGLE_CLIENT_ID
GOOGLE_CLIENT_SECRET
DATABASE_URL
SMALLEST_API_KEY
SECRET_KEY

====================================================
GOOGLE OAUTH REQUIREMENTS

Implement full OAuth 2.0 flow.

Store:

• access_token
• refresh_token
• expiry
• token_type

Auto-refresh expired tokens.

Include complete backend implementation for:

• Login endpoint
• Callback endpoint
• Token storage
• Token refresh middleware

====================================================
CALENDAR FUNCTIONALITY

Implement backend tool endpoints:

1. check_availability(emails, start_range, end_range, duration_minutes)

• Use Google freebusy.query
• Merge busy times
• Compute intersection of free slots
• Filter by duration
• Return available slots
• NEVER expose raw busy data

2. create_calendar_event(start, end, attendees)

• Use events.insert
• Generate Google Meet link
• Send invites
• Return event_id and meet_link

All internal time must be stored in UTC.
Frontend converts to user timezone.

Use robust time parsing library (e.g., dateparser).

====================================================
AI TOOL CALLING SYSTEM

Implement structured tool schemas.

Tool 1:
check_availability

Tool 2:
create_calendar_event

The LLM must:

• Return JSON tool calls
• Wait for backend execution
• Continue conversation after receiving tool results
• Never hallucinate calendar results

Provide full JSON schema definitions.

====================================================
NEGOTIATION LOGIC

The agent must:

1. Ask for:

   • Preferred date range
   • Preferred time window
   • Duration
   • Timezone

2. Retrieve availability

3. Propose 3 possible time slots

4. Handle:

   • Rejections
   • “Earlier”
   • “Later”
   • “Next week”
   • “After 3pm”

5. Confirm final slot before creating event

Include example conversation flows.

====================================================
DATABASE DESIGN

Design full schema.

Users table:

• id
• email
• name
• timezone
• created_at

OAuthTokens table:

• id
• user_id
• access_token (encrypted)
• refresh_token (encrypted)
• expiry
• created_at

Meetings table:

• id
• organizer_id
• participant_email
• start_time (UTC)
• end_time (UTC)
• google_event_id
• meet_link
• status
• created_at

Provide full SQLAlchemy models.

====================================================
FRONTEND REQUIREMENTS

Build:

• Google login button
• Chat interface
• Message bubbles
• Proposed time buttons
• Loading indicators
• Error states
• Meeting confirmation card

Use modern UI patterns.

====================================================
DOCKERIZATION

Provide:

• Dockerfile (backend)
• Dockerfile (frontend)
• docker-compose.yml
• PostgreSQL service
• .env.example file

====================================================
TESTING
================...

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.