fix: upgrade vulnerable dependencies with override enforcement (#12526)

security: upgrade vulnerable dependencies with override enforcement

- Add security overrides for orjson, gunicorn, pypdf, nltk, markdown, dynaconf, pillow
- Update base pyproject.toml: pillow>=12.0.0, pypdf>=6.9.0
- Selective upgrade: only orjson (3.11.7->3.11.8) and pillow (11.3.0->12.2.0)
- Resolves 7/8 flagged CVEs (diskcache awaiting upstream fix)
- Defense-in-depth: TOML minimums + override enforcement

Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local>

Author: 2 people

pyproject.toml

@@ -136,6 +136,14 @@ override-dependencies = [
     "python-pptx>=1.0.2",
     # z3-solver 4.15.7 dropped Linux wheels, pin until codeflash is removed
     "z3-solver<4.15.7",
+    # Security: Force upgraded versions to prevent transitive deps from pulling older vulnerable versions
+    "orjson>=3.11.6",
+    "gunicorn>=25.3.0",
+    "pypdf>=6.9.0",  # Force pypdf 6.9+ to prevent vulnerable 6.6.x versions
+    "nltk>=3.9.4",
+    "Markdown>=3.8.0",
+    "dynaconf>=3.2.13",
+    "pillow>=12.0.0",  # Force Pillow 12+ to prevent CVE-vulnerable 11.x versions
 ]
 
 [project.scripts]

src/backend/base/pyproject.toml

@@ -43,7 +43,7 @@ dependencies = [
     "alembic>=1.13.0,<2.0.0",
     "passlib>=1.7.4,<2.0.0",
     "bcrypt==4.0.1",
-    "pillow>=11.3.0,<13.0.0",
+    "pillow>=12.0.0,<13.0.0",
     "docstring-parser>=0.16,<1.0.0",
     "PyJWT>=2.12.1",
     "pandas==2.2.3",
@@ -78,7 +78,7 @@ dependencies = [
     "assemblyai>=0.33.0,<1.0.0",
     "fastapi-pagination>=0.13.1,<1.0.0",
     "defusedxml>=0.7.1,<1.0.0",
-    "pypdf>=6.6.2,<7.0.0",
+    "pypdf>=6.9.0,<7.0.0",
     "validators>=0.34.0,<1.0.0",
     "networkx>=3.4.2,<4.0.0",
     "json-repair>=0.30.3,<1.0.0",