fix(hvp-monolith): clear Trivy CVEs (nuke pkgs cache, bump numexpr, justify locked CVEs)

Three changes addressing the 12 CVEs Trivy flagged on hvp-monolith:

1. Dockerfile cleanup: remove /opt/conda/pkgs/* (was: only pkgs/cache).
   The extracted package dirs hold a second copy of every installed
   package (~9 GB) plus stale versions left behind by env solves.
   Eliminates CVE-2026-1669 (keras 3.12.0 only existed in pkgs/; base
   env has 3.14.1) and shrinks the final image.

2. env-vcontact2.yaml: pin numexpr>=2.8.5 to clear CVE-2023-39631
   (CRITICAL — langchain RCE via evaluate). 2.8.5 is the lowest fixed
   release and still py=3.8 + numpy<1.24 compatible.

3. .trivyignore: document the remaining CVEs that are upstream-locked
   and not reachable in our pipeline:
   - DVF env (py=3.6 ceiling): keras 2.2.4, setuptools 58.0.4 CVEs
   - vcontact2 env (py=3.8 ceiling): urllib3 2.2.3, setuptools 75.3.0
   - jaraco.context 5.3.0 vendored by both setuptools above
   - Ruby json/net-imap from das_tool's bioconda dep on r44 ruby

Each .trivyignore entry includes a written reachability argument and a
quarterly review reminder per AGENTS.md.

Author: jonn-smith

docker/hvp-monolith/.trivyignore

@@ -11,3 +11,66 @@
 # package is upgraded. Remove entries once the underlying package ships a fix.
 #
 # =============================================================================
+#
+# -----------------------------------------------------------------------------
+# DeepVirFinder env (python=3.6) — upstream-locked
+# -----------------------------------------------------------------------------
+# DVF (jessieren/DeepVirFinder) ships no py>3.6 support and pins keras==2.2.4
+# + theano==1.0.3. Both are pip-installed in a sidecar env. setuptools at the
+# py3.6 ceiling is 58.0.4. None of these are reachable from a workflow caller:
+# DVF is invoked only via /usr/local/bin/dvf.py against user-supplied FASTA;
+# no untrusted model download, no PyPI install at runtime, no setuptools
+# package_index calls. Accepted until DVF is replaced (tracking).
+#
+# CVE-2024-3660: keras 2.2.4 — code injection via TF Keras model load. We
+#   never load third-party model files; only the DVF-bundled weights ship in
+#   the image. Quarterly review.
+CVE-2024-3660
+# CVE-2025-12060: keras 2.2.4 — path traversal in model loading. Same scope
+#   as above; not reachable. Quarterly review.
+CVE-2025-12060
+# CVE-2024-6345: setuptools <70.0.0 — RCE via package_index download
+#   functions. We never invoke setuptools at runtime (envs are baked at build
+#   time). Hits both 58.0.4 (DVF, py3.6 ceiling) and 75.3.0 (vcontact2, py3.8
+#   ceiling). Quarterly review.
+CVE-2024-6345
+# CVE-2025-47273: setuptools <78.1.1 — path traversal in PackageIndex. Same
+#   non-reachability argument as CVE-2024-6345. Quarterly review.
+CVE-2025-47273
+#
+# -----------------------------------------------------------------------------
+# vcontact2 env (python=3.8) — upstream-locked
+# -----------------------------------------------------------------------------
+# vcontact2 0.11.3 requires python=3.8. urllib3 2.3+ requires python>=3.9, so
+# the py3.8 ceiling is urllib3 2.2.3. vcontact2 itself uses urllib3 only via
+# pandas's optional network features (we don't); the wrapper shim calls the
+# binary against local files. Accepted until vcontact2 ships py>=3.9 support.
+#
+# CVE-2026-44431: urllib3 2.2.3 — fixed in 2.7.0; not py3.8-compatible.
+#   No untrusted-URL fetch in the pipeline. Quarterly review.
+CVE-2026-44431
+#
+# -----------------------------------------------------------------------------
+# jaraco.context (vendored by setuptools)
+# -----------------------------------------------------------------------------
+# CVE-2026-23949: jaraco.context 5.3.0 — path traversal via malicious tar.
+#   Vendored inside setuptools (setuptools._vendor.jaraco.context) in the
+#   py3.6 and py3.8 sidecar envs above. Same non-reachability argument as
+#   the setuptools CVEs. Removed automatically when those envs upgrade.
+CVE-2026-23949
+#
+# -----------------------------------------------------------------------------
+# Ruby (pulled in by das_tool=1.1.7)
+# -----------------------------------------------------------------------------
+# das_tool ships .rb scripts (scg_blank_diamond.rb, scg_blank_usearch.rb,
+# scg_blank_blast.rb) that bioconda's r44 ruby runtime executes. Dropping
+# Ruby breaks das_tool; bioconda has not rebuilt das_tool on a newer Ruby
+# stdlib gem set. Neither JSON parsing nor IMAP is invoked in the
+# das_tool execution paths we use.
+#
+# CVE-2026-33210: ruby/json 2.18.0 — DoS / info disclosure via format string.
+#   das_tool's .rb scripts don't parse untrusted JSON. Quarterly review.
+CVE-2026-33210
+# CVE-2026-42246: ruby/net-imap 0.6.2 — IMAP client vulnerability. das_tool
+#   does not open any network sockets, let alone IMAP. Quarterly review.
+CVE-2026-42246

docker/hvp-monolith/Dockerfile

@@ -82,15 +82,18 @@ RUN set -e; \
 
 # Strip caches, byte-compiled modules, and docs from /opt/conda. Python will
 # regenerate __pycache__ at runtime for modules it imports; nothing here is
-# required at runtime.
+# required at runtime. The /opt/conda/pkgs/* extracted dirs hold a second copy
+# of every installed package (~9 GB) plus stale versions left behind by env
+# solves — those stale copies trip Trivy with CVEs against versions that are
+# not actually on $PATH in any env.
 RUN set -e; \
     find /opt/conda -type d -name __pycache__ -prune -exec rm -rf {} +; \
     find /opt/conda -type f -name '*.pyc' -delete; \
     find /opt/conda -type f -name '*.pyo' -delete; \
     find /opt/conda -type d -path '*/share/man*' -prune -exec rm -rf {} +; \
     find /opt/conda -type d -path '*/share/doc/*' -prune -exec rm -rf {} +; \
     find /opt/conda -type d -path '*/share/info/*' -prune -exec rm -rf {} +; \
-    rm -rf /opt/conda/pkgs/cache 2>/dev/null || true; \
+    rm -rf /opt/conda/pkgs 2>/dev/null || true; \
     rm -rf /home/$MAMBA_USER/.mamba/pkgs 2>/dev/null || true; \
     true
 

docker/hvp-monolith/env-vcontact2.yaml

@@ -11,6 +11,9 @@ dependencies:
   # vcontact2 0.11.3 uses `np.warnings.filterwarnings(...)` which numpy >=1.24
   # removed. Pin numpy below 1.24 to keep the module importable.
   - "numpy<1.24"
+  # numexpr 2.8.4 carries CVE-2023-39631 (langchain RCE via evaluate);
+  # 2.8.5+ fixes it and still solves under py=3.8 + numpy<1.24.
+  - "numexpr>=2.8.5"
   - diamond=2.1.24
   - mcl
   - clusterone