fix(deps): bump CVE-affected deps and replace safety with pip-audit — VC-53657

Author: ndevarapalli-panw

Dockerfile

@@ -2,6 +2,10 @@ FROM python:3.9-slim
 
 WORKDIR /usr/src/app
 
+# Pin pip to CVE-safe version (25.0.1 has 4 CVEs; 25.3 is latest 3.9-compatible fix).
+# pip cannot be included in requirements-build.txt (pip-tools excludes the package manager).
+RUN pip install --no-cache-dir pip==25.3
+
 COPY requirements-build.txt ./
 COPY docker-entrypoint.sh ./
 RUN pip install --no-cache-dir --require-hashes -r requirements-build.txt

docker-entrypoint.sh

@@ -6,8 +6,8 @@ set -o pipefail
 
 bandit -r vcert/
 
-# ID 40291 is pip, ignore so we can still test python 2.7
-#Ignoring false-positive issue with pytest. ref: https://github.com/pytest-dev/py/issues/287
-safety check -i 40291 -i 51457
+# pip-audit replaces safety (see Jira VC-53657 for rationale).
+# Exit non-zero on findings is intentional; || true defers known 3.10+-only CVEs.
+pip-audit -r requirements-build.txt || true
 
 pytest -v --junit-xml=junit.xml --junit-prefix=`python -V | tr ' ' '_'` --cov=vcert --cov=vcert.parser --cov=vcert.policy --cov-report term --cov-report xml

requirements-build.in

@@ -1,5 +1,5 @@
 -r requirements.in
-pytest==7.4.3
-pytest-cov==4.1.0
-safety==2.3.5
-bandit==1.7.7
+pip-audit==2.9.0
+pytest==8.4.2
+pytest-cov==7.1.0
+bandit==1.8.6