fix(deps): address code review findings — VC-53657

Author: ndevarapalli-panw

Dockerfile

@@ -2,12 +2,10 @@ FROM python:3.9-slim
 
 WORKDIR /usr/src/app
 
-# Pin pip to CVE-safe version (25.0.1 has 4 CVEs; 25.3 is latest 3.9-compatible fix).
-# pip cannot be included in requirements-build.txt (pip-tools excludes the package manager).
-RUN pip install --no-cache-dir pip==25.3
+RUN echo "pip==25.3 --hash=sha256:9655943313a94722b7774661c21049070f6bbb0a1516bf02f7c8d5d9201514cd" \
+    > /tmp/pip-pin.txt && pip install --no-cache-dir --require-hashes -r /tmp/pip-pin.txt
 
 COPY requirements-build.txt ./
-COPY docker-entrypoint.sh ./
 RUN pip install --no-cache-dir --require-hashes -r requirements-build.txt
 
 COPY . .

docker-entrypoint.sh

@@ -6,8 +6,6 @@ set -o pipefail
 
 bandit -r vcert/
 
-# pip-audit replaces safety (see Jira VC-53657 for rationale).
-# Exit non-zero on findings is intentional; || true defers known 3.10+-only CVEs.
-pip-audit -r requirements-build.txt || true
+pip-audit -r requirements-build.txt
 
 pytest -v --junit-xml=junit.xml --junit-prefix=`python -V | tr ' ' '_'` --cov=vcert --cov=vcert.parser --cov=vcert.policy --cov-report term --cov-report xml

setup.py

@@ -14,8 +14,8 @@
       version='0.19.0',
       url="https://github.com/Venafi/vcert-python",
       packages=['vcert', 'vcert.parser', 'vcert.policy'],
-      install_requires=['requests==2.32.4', 'python-dateutil==2.8.2', 'six==1.17.0',
-                        'cryptography==45.0.7', 'ruamel.yaml==0.18.13', 'pynacl==1.5.0'],
+      install_requires=['requests==2.32.4', 'python-dateutil==2.9.0.post0', 'six==1.17.0',
+                        'cryptography==48.0.1', 'ruamel.yaml==0.18.17', 'pynacl==1.6.2'],
       description='Python client library for CyberArk Certificate Manager, Self-Hosted and CyberArk Certificate Manager, SaaS.',
       long_description=long_description,
       long_description_content_type="text/markdown",

vcert/pem.py

@@ -110,7 +110,7 @@ def as_pkcs12(self, passphrase=None):
             p_key = serialization.load_pem_private_key(data=self.key.encode(), password=b_pass,
                                                        backend=default_backend())
         except Exception as e:
-            get_logger().error(msg=f"Error parsing Private Key: {e.message}")
+            get_logger().error(msg=f"Error parsing Private Key: {str(e)}")
             return
 
         name = random_word(10).encode()