Patch PyJWT and urllib3 CVEs, drop virtualenv from the runner image

[naomi-robusta]

Summary

Fixes the fixable Python findings that Vanta/GCP Artifact Analysis reports on robusta-runner:

Package	Before → After	CVEs
pyjwt	2.13.0 → 2.14.0 (first fixed; 2.15.x is < 1 month old)	CVE-2026-102268 (Critical), CVE-2026-102266/102267/102271/102272/102273 (High)
urllib3	2.7.0 → 2.8.0 (only fixed release)	CVE-2026-97687, CVE-2026-97689 (High)
virtualenv	20.39.1 → removed from image	CVE-2026-102925/102930/102937 (High)

virtualenv and filelock were in the image only because their CVE pins sat in the main dependency group; nothing at runtime needs them (only pre-commit, a dev dep). The pins moved to the dev group, so poetry install --without dev no longer installs them. The dev pin goes to 21.7.13, the first fixed release; there is no fixed 20.x. The Dockerfile cleanup of virtualenv's embedded wheel is dropped since the path no longer exists.

Not in this PR

• Go stdlib CVEs in kubectl (CVE-2026-78663, CVE-2026-56857 Critical + 9 High; need Go 1.26.9): every released kubectl (1.34–1.37) is built with Go ≤ 1.26.8. Go 1.26.9 shipped 2026-10-08; kubectl 1.35.10 is scheduled for 2026-10-13. The Dockerfile installs the latest 1.35.x from apt unpinned, so a rebuild after that release picks it up with no code change.
• pip-vendored urllib3/msgpack/setuptools (pip/_vendor): pip 26.2.1 is the latest release; no fixed pip exists yet.
• OS packages with no Debian trixie fix (gnutls28, expat, zlib, cyrus-sasl2), and scanner false positives on forky-backported attr/acl/perl.

Verification

• poetry check --lock passes (locked with Poetry 1.8.5, --no-update; only pyjwt/urllib3/virtualenv + virtualenv's new python-discovery dep change).
• Image builds; in the image: PyJWT 2.14.0, urllib3 2.8.0, virtualenv/filelock not installed; RS256 + HS256 encode/decode roundtrip, supabase and robusta.runner.main import.
• Trivy: urllib3/PyJWT/virtualenv findings on the venv gone, no new findings.
• pytest tests: 20 failed / 403 passed, identical with and without the change (pre-existing env failures: kind cluster, kubeconfig, version check).
• Dev env: pre-commit 2.21.0 runs with virtualenv 21.7.13.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RYv7FL9PA3mB4kgGU32FWV

---

Generated by Claude Code

[github-actions]

✅ Docker image ready for 95ac8de (built in 3m 10s)

• us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:95ac8de

⚠️ Warning: does not support ARM (ARM images are built on release only - not on every PR)

Use this tag to pull the image for testing.

📋 Copy commands

⚠️ Temporary images are deleted after 30 days. Copy to a permanent registry before using them:

gcloud auth configure-docker us-central1-docker.pkg.dev
docker pull us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:95ac8de
docker tag us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:95ac8de me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:95ac8de
docker push me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:95ac8de

Patch Helm values in one line:

helm upgrade --install robusta robusta/robusta \
  --reuse-values \
  --set runner.image=me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:95ac8de

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: a29ebb9f-fc08-42be-a806-e40deef76fcd

---

📥 Commits

Reviewing files that changed from the base of the PR and between db2c4f0 and d18eb51.

---

⛔ Files ignored due to path filters (1)

• poetry.lock is excluded by !**/*.lock

---

📒 Files selected for processing (2)

• Dockerfile
• pyproject.toml

---

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

---

Walkthrough

PyJWT and urllib3 constraints increased. filelock and virtualenv moved from runtime dependencies to dev dependencies. The Docker cleanup command no longer removes virtualenv’s embedded seed wheel.

Changes

Dependency and runtime image updates

Layer / File(s)	Summary
Dependency scope and image cleanup pyproject.toml, Dockerfile	PyJWT and urllib3 constraints increased. filelock and virtualenv moved to dev dependencies, with virtualenv updated to ^21.7.13. Docker cleanup continues to remove setuptools-vendored wheel files but no longer removes virtualenv’s embedded seed wheel.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: arikalon1

Merge Risk: ⚪ Minimal · up to d18eb

The dependency updates and runtime-image cleanup changes present no established merge-blocking risk.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check		The title clearly summarizes the main changes: patching PyJWT and urllib3 CVEs and removing virtualenv from the runner image.
Description check		The description directly explains the dependency updates, virtualenv and filelock relocation, validation results, and excluded findings. It is fully related to the changeset.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}