ROB-429 CVEminator 🤖 2026-06-23 (#533)

### Next Steps

After merge, build and release a new image:

```
# us-central1-docker.pkg.dev/genuine-flight-317411/devel/krr — list tags by date, bump latest.
# docker build -t us-central1-docker.pkg.dev/genuine-flight-317411/devel/krr:<new-tag> .
```

### Changes

| File | Change | CVE |
|------|--------|-----|
| `pyproject.toml` | `requests = ">2.32.4"` → `requests = ">=2.33.0"` |
CVE-2026-25645 |
| `poetry.lock` | `requests` 2.32.5 → 2.34.2 | CVE-2026-25645 |
| `requirements.txt` | `requests==2.32.5` → `requests==2.34.2` |
CVE-2026-25645 |

Refs:
- https://github.com/robusta-dev/krr/security/dependabot/69
- https://github.com/psf/requests/releases

### Test plan

- `docker build -t krr-cve-test -f Dockerfile .` — builds clean.
- `docker run --rm --entrypoint python krr-cve-test krr.py --help` — CLI
usage prints.
- `docker run --rm --entrypoint python krr-cve-test -c "import requests;
print(requests.__version__)"` → `2.34.2` (≥ 2.33.0, CVE fixed).

### Human in the loop

Nothing extra needed — single-line pin bump on a battle-tested HTTP
library, no API surface change. `requirements.txt` was edited surgically
(only the `requests==` line) rather than re-exporting from poetry,
because a fresh `poetry export` re-resolves dozens of unrelated pins and
would balloon the diff.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: RoiGlinik

poetry.lock

@@ -33,7 +33,7 @@ alive-progress = "^3.1.2"
 prometrix = "0.2.11"
 slack-sdk = "^3.21.3"
 pandas = "2.2.2"
-requests = ">2.32.4"
+requests = ">=2.33.0"
 pyyaml = "6.0.1"
 typing-extensions = "4.6.0"
 idna = "3.7"

pyproject.toml

@@ -37,7 +37,7 @@ pytz==2024.1 ; python_version >= "3.10" and python_full_version < "3.13"
 pyyaml==6.0.1 ; python_version >= "3.10" and python_full_version < "3.13"
 regex==2023.12.25 ; python_version >= "3.10" and python_full_version < "3.13"
 requests-oauthlib==1.4.1 ; python_version >= "3.10" and python_full_version < "3.13"
-requests==2.32.5 ; python_version >= "3.10" and python_full_version < "3.13"
+requests==2.34.2 ; python_version >= "3.10" and python_full_version < "3.13"
 rich==12.6.0 ; python_version >= "3.10" and python_full_version < "3.13"
 rsa==4.9 ; python_version >= "3.10" and python_full_version < "3.13"
 s3transfer==0.16.0 ; python_version >= "3.10" and python_full_version < "3.13"