fix: bump deps and base image to clear security scan CVEs

Dockerfile

@@ -13,7 +13,7 @@
 # ---------------------------------------------------------------------------
 # Stage 1: Install dependencies into a virtual environment
 # ---------------------------------------------------------------------------
-FROM dhi.io/python:3.13-alpine3.23-dev@sha256:c13970a65d92df51053ffbc9fb2696b694078e0c8f3aa7e9de01e91d810c2de7 AS builder
+FROM dhi.io/python:3.13-alpine3.23-dev@sha256:2932baee9e95d21b4baf7e898a632fa1bf1a8b6fb632d008c525fa456b3aeca2 AS builder
 
 WORKDIR /app
 
@@ -30,7 +30,7 @@ RUN uv sync --no-dev --frozen
 # ---------------------------------------------------------------------------
 # Stage 2: Production runtime — DHI Python (non-root by default)
 # ---------------------------------------------------------------------------
-FROM dhi.io/python:3.13-alpine3.23@sha256:904d8d2f5ccf6a2ebb63ca1c7a43aa0bafdeb03dae72f1174a82cc134bc530b0
+FROM dhi.io/python:3.13-alpine3.23@sha256:5b478d05c5b518d730a958352465e43eaa920416fa14468c5b59509713819062
 
 WORKDIR /app
 

pyproject.toml

@@ -11,7 +11,7 @@ dependencies = [
     "pydantic>=2.13.2",
     "pydantic-settings>=2.13.1",
     "python-dotenv>=1.2.2",  # CVE-2026-28684 - transitive dep via pydantic-settings
-    "python-multipart>=0.0.26",  # CVE-2026-40347 - transitive dep via fastapi
+    "python-multipart>=0.0.27",  # GHSA-pp6c-gr5w-3c5g - transitive dep via fastapi and mcp
     "structlog>=25.5.0",
 ]
 
@@ -28,6 +28,8 @@ security = [
     "pip-audit>=2.10.0",
     "cyclonedx-bom>=7.3.0",
     "lxml>=6.1.0",  # CVE-2026-41066 - transitive dep via cyclonedx-bom
+    "pip>=26.1",  # GHSA-jp4c-xjxw-mgf9 - transitive dep via pip-audit->pip-api
+    "urllib3>=2.7.0",  # GHSA-mf9v-mfxr-j63j, GHSA-qccp-gfcp-xxvc - transitive dep via pip-audit->cachecontrol->requests
 ]
 
 [build-system]