cp: ci: Address new CVEs from rc4 (1497) into r1.1.0

[thomasdhc]

beep boop [🤖]: Hi @thomasdhc 👋,

we've cherry picked #1497 into  for you! 🚀

Please review and approve this cherry pick by your convenience!

[thomasdhc]

/ok to test 1266c52

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[greptile-apps]

Greptile Overview

Greptile Summary

This cherry-pick from #1497 addresses multiple security vulnerabilities by upgrading dependencies and system packages. The PR includes:

• Upgraded gnupg package in Docker to address CVE-2025-68973
• Updated Python dependency constraints for cryptography (>=46.0.5), nbconvert (>=7.17.0), pillow (>=12.1.1), and protobuf (>=5.29.6)
• Corresponding uv.lock updates to enforce the new minimum versions

All changes are security-focused dependency bumps that align with the original PR. The cherry-pick appears clean with no conflicts.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• Clean cherry-pick of security fixes from ci: Address new CVEs from rc4 #1497 to the r1.1.0 release branch. All changes are dependency version bumps addressing known CVEs with proper Docker cleanup. No functional logic changes or potential regressions.
• No files require special attention

Important Files Changed

Filename	Overview
docker/Dockerfile	Added gnupg upgrade to address CVE-2025-68973 with proper cleanup
pyproject.toml	Updated dependency constraints for cryptography, nbconvert, pillow, and protobuf to address multiple CVEs
uv.lock	Lock file updated to reflect new dependency constraints (161 lines changed)

[greptile-apps]

_{3 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}