ROB-623: bump python deps to fix CVEs

[Avi-Robusta]

Fixes CVEs flagged for the robusta image in the 2026-07-14 Vanta scan (sub-issue ROB-623 of ROB-595).

Dependency bumps

Package	From	To	CVE
pyjwt	2.12.1	2.13.0	CVE-2026-48526 (High)
tornado	6.5.5	6.5.7	CVE-2026-49853, CVE-2026-49855 (High)
cryptography	46.0.7	48.0.1	GHSA-537c-gmf6-5ccf (High)
python-dotenv	0.18.0	1.2.2	CVE-2026-28684 (Medium)

Only these four packages change version in the lock file. python-dotenv (0.18 → 1.2) is not imported directly in src/; the four bumped packages install and import together cleanly in a venv smoke test.

SLA: before 2026-07-21 (pyjwt due 16 Jul).

🤖 Generated with Claude Code

[github-actions]

✅ Docker image ready for 8ea44c1 (built in 3m 41s)

• us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:8ea44c1

⚠️ Warning: does not support ARM (ARM images are built on release only - not on every PR)

Use this tag to pull the image for testing.

📋 Copy commands

⚠️ Temporary images are deleted after 30 days. Copy to a permanent registry before using them:

gcloud auth configure-docker us-central1-docker.pkg.dev
docker pull us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:8ea44c1
docker tag us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:8ea44c1 me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:8ea44c1
docker push me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:8ea44c1

Patch Helm values in one line:

helm upgrade --install robusta robusta/robusta \
  --reuse-values \
  --set runner.image=me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:8ea44c1

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 60169825-9798-4d8e-8c6c-25ed3370610a

📥 Commits

Reviewing files that changed from the base of the PR and between 05f75e8 and bae0007.

⛔ Files ignored due to path filters (1)

• poetry.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• pyproject.toml

---

Walkthrough

Updates four dependency version pins in pyproject.toml, adding or retaining inline comments referencing security advisories.

Changes

Dependency Security Updates

Layer / File(s)	Summary
Update dependency version pins pyproject.toml	Raises the minimum versions for cryptography, pyjwt, python-dotenv, and tornado, with inline advisory comments.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: moshemorad, roiglinik

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: bumping Python dependencies to address CVEs.
Description check	✅ Passed	The description clearly matches the dependency bumps and CVE-fix goal of the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch avi/rob-623-cve-robusta

---

_{Comment @coderabbitai help to get the list of available commands.}