ROB-1636 Bump urllib3 to 2.8.0 and drop pip from the image to fix CVEs (#556)

## Summary
- **urllib3** 2.7.0 → 2.8.0 in `pyproject.toml`, `poetry.lock`,
`requirements.txt` and `enforcer/requirements.txt`. Fixes CVE-2026-97687
and CVE-2026-97689 (High). Closes dependabot alerts #122, #123, #125,
#126, #128 and #129, and the matching Artifact Registry findings on
`devel/krr`.
- **Dockerfile**: pip is uninstalled once the requirements are
installed. pip 26.2.1, the latest release, vendors its own urllib3
2.7.0, so the dependency bump alone left the CVEs in the image. krr
never calls pip at runtime. The pip upgrade, requirements install and
uninstall run in one `RUN`, so the upgraded pip never lands in an image
layer (CodeRabbit's finding, now fixed).

Linear: [ROB-1636](https://linear.app/robusta/issue/ROB-1636)

## Verification
- `poetry lock --no-update` with Poetry 1.8.5: only urllib3 changes in
the lock. `poetry check --lock` passes.
- `pytest`: 55 passed.
- Built the image for `linux/amd64` and scanned it with Trivy (Docker
Scout isn't available in the sandbox). The Python packages have no HIGH
or CRITICAL findings. Before this change the image showed urllib3 2.7.0
(pip's vendored copy) and msgpack 1.1.2. `docker history` shows no
separate pip layer.
- Built for `linux/arm64` under QEMU (from the commit before the
single-`RUN` change, so the same packages): it runs on `aarch64`, Trivy
reports the same results as amd64, urllib3 is 2.8.0, and pip is gone.
- In both images `krr.py simple --help` works.
- Not tested: a rescan in Artifact Registry. The Vanta finding clears
only after CI publishes the image.

Out of scope:
- `gcc-14` CVE-2026-95619 (Low, no Debian fix) and 10 unfixed Debian
HIGHs, unchanged from `main`.
- The `enforcer` image installs pip the same way, but Vanta has not
flagged it.
- The enforcer README's "Python 3.9+" was already wrong before this PR.
It's tracked in [ROB-1650](https://linear.app/robusta/issue/ROB-1650).

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Fq7hqRqj2kshg8M2sFpN7h)_

---------

Signed-off-by: Claude <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: Sheeproid

Dockerfile

@@ -19,12 +19,15 @@ WORKDIR /app
 
 COPY ./requirements.txt requirements.txt
 
-RUN pip install --no-cache-dir --upgrade pip
-# Install the project dependencies
-RUN python -m ensurepip --upgrade
-# Bundled pip 25.0.1 wheel carries CVE-2025-8869, CVE-2026-3219/6357/8643
-RUN rm -f /usr/local/lib/python3.12/ensurepip/_bundled/pip-*.whl
-RUN pip install --no-cache-dir -r requirements.txt
+# Install the project dependencies, then drop pip: 26.2.1 (latest) vendors
+# urllib3 2.7.0 (CVE-2026-97687, CVE-2026-97689) and krr never calls pip at
+# runtime. One RUN so the upgraded pip never lands in an image layer.
+# The bundled pip 25.0.1 wheel carries CVE-2025-8869, CVE-2026-3219/6357/8643.
+RUN pip install --no-cache-dir --upgrade pip \
+    && python -m ensurepip --upgrade \
+    && rm -f /usr/local/lib/python3.12/ensurepip/_bundled/pip-*.whl \
+    && pip install --no-cache-dir -r requirements.txt \
+    && pip uninstall -y pip
 
 # Copy the rest of the application code
 COPY ./krr.py krr.py

enforcer/requirements.txt

@@ -9,4 +9,4 @@ prometheus-client==0.20.0
 python-json-logger==3.3.0
 kubernetes==26.1.0
 pyasn1>=0.6.2
-urllib3==2.7.0
+urllib3==2.8.0

poetry.lock

@@ -38,7 +38,7 @@ pyyaml = "6.0.1"
 # pytest-asyncio >=1.3 (needed for pytest 9 / CVE-2025-71176) requires typing-extensions >=4.12
 typing-extensions = ">=4.12.0,<5"
 idna = "3.15"
-urllib3 = "^2.7.0"
+urllib3 = "^2.8.0"
 setuptools = "^83.0.0"
 # transitive deps pinned for CVE fixes
 pillow = "^12.3.0"

pyproject.toml

@@ -51,7 +51,7 @@ typer==0.7.0 ; python_version >= "3.10" and python_full_version < "3.13"
 typing-extensions==4.16.0 ; python_version >= "3.10" and python_full_version < "3.13"
 tzdata==2024.1 ; python_version >= "3.10" and python_full_version < "3.13"
 tzlocal==5.2 ; python_version >= "3.10" and python_full_version < "3.13"
-urllib3==2.7.0 ; python_version >= "3.10" and python_full_version < "3.13"
+urllib3==2.8.0 ; python_version >= "3.10" and python_full_version < "3.13"
 websocket-client==1.7.0 ; python_version >= "3.10" and python_full_version < "3.13"
 zipp==3.20.2 ; python_version >= "3.10" and python_full_version < "3.13"
 # required for tests