Clear the 8 waived upstream-capped HIGH findings

[roman1887]

Problem

#241 brought fixable CRITICAL/HIGH findings from 91 to 8. The remaining 8 are waived in security/vulnerability-allowlist.txt because a fix exists upstream but we cannot take it — each is capped by a dependency, or has no released fix.

They are waived, not resolved. Each needs revisiting when the upstream constraint lifts. The CI gate passes today because of these waivers, so if a waiver is removed without the underlying fix, the build fails — which is the intended behaviour.

The findings

1. CPython — CVE-2026-15308 (all Python images, 5 of the 8)

• Affects python 3.13.14, our current base.
• The only fixed version is CPython 3.15.0, which is unreleased. 3.14.6 is also affected, so dependabot's 3.14 bump (chore(deps): bump python from 3.13-slim to 3.14-slim in /nexus in the docker-minor-patch group across 1 directory #213/chore(deps): bump python from 3.13-slim to 3.14-slim in /schema-service in the docker-minor-patch group across 1 directory #214) does not help — see security/DEPENDABOT_TRIAGE.md.
• Action: bump the base when 3.15 ships and the ML wheel ecosystem catches up, then delete the waiver.
• Note: Eliminate remaining CRITICAL CVEs: migrate nexus to an Alpine base #243 and Investigate Alpine/musl base for schema-service and prediction workers #244 may make this moot — python:3.13-alpine scans at 0 CRITICAL / 3 HIGH.
• Review: 2026-11

2. transformers 4.57.6 — GHSA-29pf-2h5f-8g72, GHSA-fgcw-684q-jj6r (autogluon)

• Fixed in transformers 5.3.0 and 5.5.0.
• Blocked: autogluon.timeseries 1.5.0 pins transformers[sentencepiece]<4.58.
• Both advisories concern loading untrusted model checkpoints. The worker loads only models we ship, so the affected path is not reachable — this is why it is a waiver rather than a blocker.
• Action: watch for an autogluon release that raises the cap. Track autogluon/autogluon releases.
• Review: 2026-10

3. pyarrow 20.0.0 — GHSA-rgxp-2hwp-jwgg (autogluon)

• Fixed in pyarrow 23.0.1.
• Blocked: autogluon-common 1.5.0 requires pyarrow<21.0.0. Pinning above the cap was attempted and makes the dependency set unresolvable:

  ERROR: Cannot install autogluon.timeseries and pyarrow>=23.0.1 because these
  package versions have conflicting dependencies.
      autogluon-common 1.5.0 depends on pyarrow<21.0.0 and >=7.0.0
  

• Action: same as above — gated on an autogluon release.
• Review: 2026-10

Recommended fix

1. Set a recurring check against the review dates in security/vulnerability-allowlist.txt. The SBOM and Vulnerability Scan workflow already runs weekly, so a lifted cap will surface as a newly-fixable finding.
2. When a constraint lifts: bump the dependency, delete the waiver line, confirm CI passes without it.
3. If autogluon does not raise its caps within a couple of releases, weigh whether autogluon.timeseries is worth the two capped dependencies — the xgboost and lightgbm workers have no equivalent problem.

Note on severity

These are HIGH, not CRITICAL. All fixable CRITICALs were resolved in #241. The remaining CRITICALs are base-OS findings with no upstream fix, tracked in #243 and #244.

Related: #241, #243, #244