chore: refresh vulnerable Docker dependencies

Dockerfile

@@ -136,6 +136,7 @@ else\n\
 fi' > /tmp/install.sh && chmod +x /tmp/install.sh
 
 COPY . /tmp/project/
+RUN rm -rf /tmp/project/sbom
 
 # Copy supervisor config first (might need root later, but okay for now)
 COPY deploy/docker/supervisord.conf .
@@ -167,7 +168,7 @@ RUN if [ "$INSTALL_TYPE" = "all" ] ; then \
         pip install "/tmp/project" ; \
     fi
 
-RUN pip install --no-cache-dir --upgrade pip && \
+RUN pip install --no-cache-dir --upgrade pip setuptools wheel && \
     /tmp/install.sh && \
     python -c "import crawl4ai; print('✅ crawl4ai is ready to rock!')" && \
     python -c "from playwright.sync_api import sync_playwright; print('✅ Playwright is feeling dramatic!')"
@@ -176,6 +177,9 @@ RUN crawl4ai-setup
 
 RUN playwright install --with-deps
 
+RUN apt-get update && apt-get dist-upgrade -y \
+    && rm -rf /var/lib/apt/lists/*
+
 RUN mkdir -p /home/appuser/.cache/ms-playwright \
     && cp -r /root/.cache/ms-playwright/chromium-* /home/appuser/.cache/ms-playwright/ \
     && chown -R appuser:appuser /home/appuser/.cache/ms-playwright
@@ -217,4 +221,4 @@ USER appuser
 ENV PYTHON_ENV=production 
 
 # Start the application using supervisord
-CMD ["supervisord", "-c", "supervisord.conf"]
+CMD ["supervisord", "-c", "supervisord.conf"]

deploy/docker/requirements.txt

@@ -1,4 +1,5 @@
 fastapi>=0.115.12
+aiohttp>=3.13.3
 uvicorn>=0.34.2
 gunicorn>=23.0.0
 slowapi==0.1.9
@@ -11,7 +12,12 @@ sse-starlette==2.2.1
 pydantic>=2.11
 rank-bm25==0.2.2
 anyio==4.9.0
-PyJWT==2.10.1
+PyJWT>=2.12.0,<3
+urllib3>=2.7.0
+cryptography>=46.0.5
+pyOpenSSL>=26.0.0
+setuptools>=78.1.1
+wheel>=0.46.2
 mcp>=1.18.0
 websockets>=15.0.1
 httpx[http2]>=0.27.2

pyproject.toml

@@ -14,13 +14,13 @@ authors = [
 ]
 dependencies = [
     "aiofiles>=24.1.0",
-    "aiohttp>=3.11.11",
+    "aiohttp>=3.13.3",
     "aiosqlite~=0.20",
     "anyio>=4.0.0",
-    "lxml~=5.3",
+    "lxml>=6.1.0",
     "unclecode-litellm==1.81.13",
     "numpy>=1.26.0,<3",
-    "pillow>=10.4",
+    "pillow>=12.2.0",
     "playwright>=1.49.0",
     "patchright>=1.49.0",
     "python-dotenv~=1.0",
@@ -31,18 +31,20 @@ dependencies = [
     "rank-bm25~=0.2",
     "snowballstemmer~=2.2",
     "pydantic>=2.10",
-    "pyOpenSSL>=25.3.0",
+    "pyOpenSSL>=26.0.0",
+    "cryptography>=46.0.5",
+    "urllib3>=2.7.0",
     "psutil>=6.1.1",
     "PyYAML>=6.0",
-    "nltk>=3.9.1",
+    "nltk>=3.9.4",
     "rich>=13.9.4",
     "cssselect>=1.2.0",
     "httpx>=0.27.2",
     "httpx[http2]>=0.27.2",
     "fake-useragent>=2.0.3",
     "click>=8.1.7",
     "chardet>=5.2.0",
-    "brotli>=1.1.0",
+    "brotli>=1.2.0",
     "humanize>=4.10.0",
     "lark>=1.2.2",
     "alphashape>=1.3.1",

requirements.txt

@@ -1,13 +1,13 @@
 # Note: These requirements are also specified in pyproject.toml
 # This file is kept for development environment setup and compatibility
 aiofiles>=24.1.0
-aiohttp>=3.11.11
+aiohttp>=3.13.3
 aiosqlite~=0.20
 anyio>=4.0.0
-lxml~=5.3
+lxml>=6.1.0
 unclecode-litellm==1.81.13
 numpy>=1.26.0,<3
-pillow>=10.4
+pillow>=12.2.0
 playwright>=1.49.0
 patchright>=1.49.0
 python-dotenv~=1.0
@@ -19,18 +19,20 @@ rank-bm25~=0.2
 colorama~=0.4
 snowballstemmer~=2.2
 pydantic>=2.10
-pyOpenSSL>=25.3.0
+pyOpenSSL>=26.0.0
+cryptography>=46.0.5
+urllib3>=2.7.0
 psutil>=6.1.1
 PyYAML>=6.0
-nltk>=3.9.1
+nltk>=3.9.4
 rich>=13.9.4
 cssselect>=1.2.0
 chardet>=5.2.0
-brotli>=1.1.0
+brotli>=1.2.0
 httpx[http2]>=0.27.2
 alphashape>=1.3.1
 shapely>=2.0.0
 
 fake-useragent>=2.2.0
 pdf2image>=1.17.0
-pypdf>=6.0.0
+pypdf>=6.0.0