fix(deps): raise the python-multipart floor to the locked version (#2773)

The declared floor was python-multipart>=0.0.27 while uv.lock resolves 0.0.32.
0.0.27 falls inside four published advisories, so any resolve that honours the
floor rather than the lock can land on a vulnerable release:

- GHSA-5rvq-cxj2-64vf / GHSA-6jv3-5f52-599m / GHSA-vffw-93wf-4j4q (quadratic-time
  querystring DoS, semicolon field-separator and Content-Disposition parameter
  smuggling), fixed in 0.0.30
- GHSA-v9pg-7xvm-68hf (negative Content-Length buffers the entire body), fixed in
  0.0.31

The locked 0.0.32 has no known advisories. Raising the floor to match the lock
costs nothing and keeps the two from drifting apart.

Reachability, for the record: multipart parsing happens on the skills and plugin
local-upload routes, both of which require USER_TOKEN_OR_API_KEY with
RESOURCE_MANAGE, so this is an authenticated-admin DoS rather than an anonymous
one.

The resolved version is unchanged; only the requirement metadata moves.

Co-authored-by: multica-agent <[email protected]>

pyproject.toml

@@ -66,7 +66,7 @@ dependencies = [
     "langchain>=1.3.9",
     "langchain-core>=1.3.3",
     "langsmith>=0.8.18",
-    "python-multipart>=0.0.27",
+    "python-multipart>=0.0.32",
     "Mako>=1.4.2",
     "langchain-text-splitters>=1.1.2",
     "chromadb>=1.0.0,<2.0.0",

uv.lock

@@ -2272,7 +2272,7 @@ requires-dist = [
     { name = "pypdf", specifier = ">=6.0.0" },
     { name = "pyseekdb", marker = "extra == 'seekdb'", specifier = "==1.4.0.post1" },
     { name = "python-docx", specifier = ">=1.1.0" },
-    { name = "python-multipart", specifier = ">=0.0.27" },
+    { name = "python-multipart", specifier = ">=0.0.32" },
     { name = "python-socks", specifier = ">=2.7.1" },
     { name = "python-telegram-bot", specifier = ">=22.0" },
     { name = "pyyaml", specifier = ">=6.0.2" },