[shaahji]

Update MCP lockfile to address Component Governance finding

Checklist before requesting a review

• Add unit tests for this change.
• Make sure all tests can pass.
• Update documents if necessary.
• Lint and apply fixes to your code by running lintrunner -a
• Is this a user-facing change? If yes, give a description of this change to be included in the release notes.

(Optional) Issue link

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[Xiaoyu Z (xiaoyu-work)]

is this for our internal compliance only? but Olive is open sourced and users may need pypi feed?

[shaahji]

is this for our internal compliance only? but Olive is open sourced and users may need pypi feed?

That's a good point. I just compared the updates and all web address for dependencies are now pointing to internal feed. With MS policy to not be able to download from pypi, I don't know how I can generate this file without the address pointing to internal feed. Do you know a way around it?

[shaahji]

Resolved the references to internal feed by generating the file thru' public workflow automation. GitHub workflows don't use isolated network so the upgrade job can reach pypi.org and update the file using publicly accessible web links.