Merge branch 'fix/TG-1120-misc-fixes' into 'enterprise'

fix: miscellaneous fixes (TG-1120 zip3 overflow, image CVE patches, project_memberships grant)

See merge request dkinternal/testgen/dataops-testgen!560

Author: ci bot

deploy/testgen-base.dockerfile

@@ -27,9 +27,7 @@ RUN apk update && apk upgrade && apk add --no-cache \
     openblas=0.3.30-r2 \
     openblas-dev=0.3.30-r2 \
     unixodbc=2.3.14-r0 \
-    unixodbc-dev=2.3.14-r0 \
-    libarrow=21.0.0-r4 \
-    apache-arrow-dev=21.0.0-r4
+    unixodbc-dev=2.3.14-r0
 
 COPY --chmod=775 ./deploy/install_linuxodbc.sh /tmp/dk/install_linuxodbc.sh
 RUN /tmp/dk/install_linuxodbc.sh
@@ -39,7 +37,7 @@ COPY ./pyproject.toml /tmp/dk/pyproject.toml
 RUN mkdir /dk
 
 # Upgrading pip for security
-RUN python3 -m pip install --no-cache-dir --upgrade pip==26.0
+RUN python3 -m pip install --no-cache-dir --upgrade pip==26.1.2
 
 # hdbcli only ships manylinux wheels (no musl). pip 26+ correctly rejects these on Alpine.
 # We download the wheel for the correct arch, then extract it directly into site-packages
@@ -73,8 +71,7 @@ RUN apk del \
     openssl \
     linux-headers \
     openblas-dev \
-    unixodbc-dev \
-    apache-arrow-dev
+    unixodbc-dev
 
 # Remove interactive ODBC tools — not needed at runtime, and iusql triggers
 # false-positive secret detection in security scanners (SECRET-3010)

pyproject.toml

@@ -61,7 +61,7 @@ dependencies = [
     "xlsxwriter==3.2.0",
     "psutil==5.9.8",
     "concurrent_log_handler==0.9.25",
-    "cryptography==46.0.6",
+    "cryptography==46.0.7",
     "validators==0.33.0",
     "reportlab==4.2.2",
     "cron-converter==1.2.1",
@@ -72,7 +72,7 @@ dependencies = [
     "holidays~=0.89",
 
     # Pinned to match the manually compiled libs or for security
-    "pyarrow==21.0.0",
+    "pyarrow==23.0.1",
     "matplotlib==3.9.2",
     "scipy==1.14.1",
     "jinja2==3.1.6",
@@ -82,7 +82,7 @@ dependencies = [
     # MCP server
     "mcp[cli]==1.26.0",
     "uvicorn==0.41.0",
-    "PyJWT==2.12.0",
+    "PyJWT==2.13.0",
     "bcrypt==5.0.0",
 
     # API & OAuth server

testgen/template/dbsetup/075_grant_role_rights.sql

@@ -44,6 +44,7 @@ GRANT SELECT, INSERT, DELETE, UPDATE ON
     {SCHEMA_NAME}.job_executions,
     {SCHEMA_NAME}.settings,
     {SCHEMA_NAME}.notification_settings,
+    {SCHEMA_NAME}.project_memberships,
     {SCHEMA_NAME}.test_definition_notes,
     {SCHEMA_NAME}.oauth2_clients,
     {SCHEMA_NAME}.oauth2_authorization_codes,

testgen/template/dbsetup_anomaly_types/profile_anomaly_types_Invalid_Zip3_USA.yaml

@@ -16,7 +16,7 @@ profile_anomaly_types:
   suggested_action: |-
     Review your source data, ingestion process, and any processing steps that update this column.
   dq_score_prevalence_formula: |-
-    (NULLIF(p.record_ct, 0)::INT - NULLIF(SPLIT_PART(p.top_patterns, ' | ', 1), '')::BIGINT)::FLOAT/NULLIF(p.record_ct, 0)::FLOAT
+    (NULLIF(p.record_ct, 0) - NULLIF(SPLIT_PART(p.top_patterns, ' | ', 1), '')::BIGINT)::FLOAT/NULLIF(p.record_ct, 0)::FLOAT
   dq_score_risk_factor: '1'
   dq_dimension: Validity
   impact_dimension: Conformance