fix(security): patch HIGH/CRITICAL image CVEs

- pyarrow 21.0.0 -> 23.0.1 (CVE-2026-25087, HIGH)
- PyJWT 2.12.0 -> 2.13.0 (CVE-2026-48526 HIGH + 3 MED + 1 LOW)
- cryptography 46.0.6 -> 46.0.7 (CVE-2026-39892, MED)
- base image: remove unused system Arrow packages (libarrow, apache-arrow-dev).
  pyarrow ships a self-contained musllinux wheel, so the apk Arrow libs were
  dead weight pulling in grpc (CVE-2026-33186, CRITICAL) and protobuf
  (CVE-2026-0994, HIGH) as runtime deps. Removing them also drops ~110 MB.
- pip 26.0 -> 26.1.2 (3 MED)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: aarthy-dk

deploy/testgen-base.dockerfile

@@ -27,9 +27,7 @@ RUN apk update && apk upgrade && apk add --no-cache \
     openblas=0.3.30-r2 \
     openblas-dev=0.3.30-r2 \
     unixodbc=2.3.14-r0 \
-    unixodbc-dev=2.3.14-r0 \
-    libarrow=21.0.0-r4 \
-    apache-arrow-dev=21.0.0-r4
+    unixodbc-dev=2.3.14-r0
 
 COPY --chmod=775 ./deploy/install_linuxodbc.sh /tmp/dk/install_linuxodbc.sh
 RUN /tmp/dk/install_linuxodbc.sh
@@ -39,7 +37,7 @@ COPY ./pyproject.toml /tmp/dk/pyproject.toml
 RUN mkdir /dk
 
 # Upgrading pip for security
-RUN python3 -m pip install --no-cache-dir --upgrade pip==26.0
+RUN python3 -m pip install --no-cache-dir --upgrade pip==26.1.2
 
 # hdbcli only ships manylinux wheels (no musl). pip 26+ correctly rejects these on Alpine.
 # We download the wheel for the correct arch, then extract it directly into site-packages
@@ -73,8 +71,7 @@ RUN apk del \
     openssl \
     linux-headers \
     openblas-dev \
-    unixodbc-dev \
-    apache-arrow-dev
+    unixodbc-dev
 
 # Remove interactive ODBC tools — not needed at runtime, and iusql triggers
 # false-positive secret detection in security scanners (SECRET-3010)

pyproject.toml

@@ -61,7 +61,7 @@ dependencies = [
     "xlsxwriter==3.2.0",
     "psutil==5.9.8",
     "concurrent_log_handler==0.9.25",
-    "cryptography==46.0.6",
+    "cryptography==46.0.7",
     "validators==0.33.0",
     "reportlab==4.2.2",
     "cron-converter==1.2.1",
@@ -72,7 +72,7 @@ dependencies = [
     "holidays~=0.89",
 
     # Pinned to match the manually compiled libs or for security
-    "pyarrow==21.0.0",
+    "pyarrow==23.0.1",
     "matplotlib==3.9.2",
     "scipy==1.14.1",
     "jinja2==3.1.6",
@@ -82,7 +82,7 @@ dependencies = [
     # MCP server
     "mcp[cli]==1.26.0",
     "uvicorn==0.41.0",
-    "PyJWT==2.12.0",
+    "PyJWT==2.13.0",
     "bcrypt==5.0.0",
 
     # API & OAuth server