ROB-631: krr-enforcer CVE fixes (starlette + urllib3 + openssl)

[Avi-Robusta]

Sub-issue ROB-631 of ROB-595. Fixes the CVEs flagged for devel/krr-enforcer in the 2026-07-14 Vanta scan.

Problem

The 0.3.8 enforcer/requirements.txt appeared to resolve these but did not:

• urllib3==2.6.3 is still vulnerable (CVE-2026-44431/44432).
• fastapi==0.121.3 caps starlette<0.51.0, so the starlette CVEs could never be pulled in.

Fix

Package	From	To	CVE
urllib3	2.6.3	2.7.0	CVE-2026-44431, CVE-2026-44432
fastapi	0.121.3	0.139.0	(drops the starlette<0.51 cap)
starlette	(capped 0.50)	1.3.1	CVE-2026-48818, 54283, 48710, 48817, 54282
pydantic	2.6.1	2.13.4	required by fastapi 0.139.0

Base image already rebuilt on Alpine 3.24 (openssl/libcrypto3 patched) in the prior 0.3.8 commit.

Validation

• docker scout cves on the rebuilt devel/krr-enforcer:0.3.8: no vulnerable packages detected.
• Deployed to avi-test-cluster2 (monitoring/krr-enforcer-krr-enforcer) — pod healthy, connected to the Robusta platform (stg), webhook server up, owners loaded.
• App imports verified with the upgraded fastapi/starlette/pydantic stack.

🤖 Generated with Claude Code

[coderabbitai]

Walkthrough

The enforcer dependency pins were updated, and the Helm chart version, application version, and container image tag were aligned to 0.3.8.

Changes

Enforcer release updates

Layer / File(s)	Summary
Enforcer dependency updates enforcer/requirements.txt	fastapi, pydantic, and urllib3 were updated to newer versions; other listed requirements remained unchanged.
Helm release alignment helm/krr-enforcer/Chart.yaml, helm/krr-enforcer/values.yaml	Chart metadata and the container image tag were updated to 0.3.8.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• robusta-dev/krr#488: Updates the same Helm chart metadata and enforcer image tag fields.
• robusta-dev/krr#494: Modifies the urllib3 dependency in enforcer/requirements.txt.
• robusta-dev/krr#529: Updates urllib3 to 2.7.0 in the same requirements file.

Suggested reviewers: moshemorad, naomi-robusta, sheeproid

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the main theme of CVE-related dependency fixes in krr-enforcer, though it mentions openssl/starlette more than the changed files show.
Description check	✅ Passed	The description is directly about the krr-enforcer CVE dependency updates and validation performed for this PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch avi/enforcer-0.3.8-cve

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@enforcer/requirements.txt`:
- Line 4: Update the Starlette dependency declaration in
enforcer/requirements.txt from the open-ended minimum version to an exact pin at
1.3.1.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d8c885eb-3b8c-49ca-a8ec-48258f26a31b

📥 Commits

Reviewing files that changed from the base of the PR and between c4f5c80 and cc13e1b.

📒 Files selected for processing (3)

• enforcer/requirements.txt
• helm/krr-enforcer/Chart.yaml
• helm/krr-enforcer/values.yaml