fix(hvp-monolith): drop unsolvable numexpr pin, ignore CVE-2023-39631

conda-forge has no numexpr>=2.8.5 build for py3.8 (vcontact2's locked
python). Local build solver rejected `numexpr>=2.8.5` with:
  numexpr 2.8.6/2.8.7/2.9.0 require py3.10+/py3.12 abi
  python=3.8 has no compatible numexpr>=2.8.5

Revert the pin (vcontact2 0.11.3 + py3.8 still gets numexpr 2.8.4) and
add CVE-2023-39631 to .trivyignore with the same py3.8-ceiling
justification used for urllib3 and setuptools in the vcontact2 env.

Local amd64 build smoke-tests every env (base/viral/dvf/vcontact2/checkm2)
and every CLI wrapper; all pass. Final image: 11.94 GB.

Author: jonn-smith

docker/hvp-monolith/.trivyignore

@@ -49,6 +49,12 @@ CVE-2025-47273
 # CVE-2026-44431: urllib3 2.2.3 — fixed in 2.7.0; not py3.8-compatible.
 #   No untrusted-URL fetch in the pipeline. Quarterly review.
 CVE-2026-44431
+# CVE-2023-39631: numexpr 2.8.4 — RCE via evaluate() with untrusted input.
+#   Fixed in 2.8.5, but conda-forge has no py3.8 build of numexpr >= 2.8.5
+#   (2.8.5+ require py>=3.9). vcontact2 doesn't expose user-controlled
+#   strings to numexpr.evaluate; pandas pulls numexpr as an optional speed-up.
+#   Quarterly review.
+CVE-2023-39631
 #
 # -----------------------------------------------------------------------------
 # jaraco.context (vendored by setuptools)

docker/hvp-monolith/env-vcontact2.yaml

@@ -11,9 +11,6 @@ dependencies:
   # vcontact2 0.11.3 uses `np.warnings.filterwarnings(...)` which numpy >=1.24
   # removed. Pin numpy below 1.24 to keep the module importable.
   - "numpy<1.24"
-  # numexpr 2.8.4 carries CVE-2023-39631 (langchain RCE via evaluate);
-  # 2.8.5+ fixes it and still solves under py=3.8 + numpy<1.24.
-  - "numexpr>=2.8.5"
   - diamond=2.1.24
   - mcl
   - clusterone