fix(security): bump mlflow and urllib3 for CVE remediation (#2560)

Signed-off-by: Kajal Jain <kajalj@nvidia.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: kajalj22

pyproject.toml

@@ -51,7 +51,7 @@ dependencies = [
   "torchvision==0.26.0",
   "transformers==5.3.0",
   "num2words>=0.5.14",                                                                                                # for SmolVLM
-  "mlflow>=3.11.1",
+  "mlflow>=3.12.0",
   "nvidia-nvshmem-cu13; sys_platform == 'linux' and (platform_machine == 'x86_64' or platform_machine == 'aarch64')", # for deep_ep build
   "swanlab",
   "pyzmq",
@@ -327,7 +327,7 @@ override-dependencies = [
   # Override sglang's xgrammar==0.1.32 to address CVE GHSA-7rgv-gqhr-fxg3
   "xgrammar==0.1.33",
   # Override dependencies to address CVEs
-  "mlflow>=3.11.1",
+  "mlflow>=3.12.0",
   # Override outlines for Python 3.13 support
   "outlines>=0.2.0",
   # Upgrade pytest to 9.0.3
@@ -343,7 +343,7 @@ override-dependencies = [
 constraint-dependencies = [
   "brotli>=1.2.0",            # Address CVE GHSA-2qfp-q593-8484
   "starlette>=0.49.1",        # Address CVE GHSA-7f5h-v6xp-fcq8
-  "urllib3>=2.6.3",           # Address CVE GHSA-38jv-5279-wg99
+  "urllib3>=2.7.0",           # Address CVE GHSA-38jv-5279-wg99
   "aiohttp>=3.13.3",          # Address CVE GHSA-mqqc-3gqh-h2x8
   "pyasn1>=0.6.3",            # Address CVE GHSA-jr27-m4p2-rc6r
   "wheel>=0.46.2",            # Address CVE GHSA-8rrh-rw8j-w5fx