fix: resolve security vulnerabilities and code quality issues

- Fix clear-text logging of sensitive data (CodeQL py/clear-text-logging-sensitive-data)
- Pin ca-certificates to version 20250419 (Hadolint DL3008)
- Format detect_secrets.py (Ruff formatting)
- Update uv.lock with urllib3 dependency
- Update setuptools requirement for security

Author: fgogolli

Dockerfile

@@ -10,7 +10,7 @@ FROM python:${PYTHON_VERSION}-slim
 RUN apt-get update && \
     apt-get upgrade -y && \
     apt-get install -y --no-install-recommends \
-        ca-certificates && \
+        ca-certificates=20250419 && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
@@ -21,7 +21,7 @@ ARG PACKAGE_NAME_SHORT=orb
 RUN apt-get update && \
     apt-get upgrade -y && \
     apt-get install -y --no-install-recommends \
-        ca-certificates && \
+        ca-certificates=20250419 && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
     # Security: Upgrade setuptools to latest version
@@ -50,7 +50,7 @@ ENV BUILD_DATE="${BUILD_DATE}" \
 
 # Install runtime dependencies and create user in single layer
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates \
+    ca-certificates=20250419 \
     && rm -rf /var/lib/apt/lists/* \
     && apt-get clean \
     && groupadd -r "${PACKAGE_NAME_SHORT:-orb}" \

dev-tools/security/detect_secrets.py

@@ -48,17 +48,17 @@ def detect_secrets(source_dir: str = "src") -> bool:
                 for _match in matches:
                     # Check if this is an exception
                     if not any(exc in line for exc in exceptions):
-                        found_secrets.append(f"{py_file}:{line_num}: {line.strip()}")
+                        # Store only file path and line number to avoid retaining secret content
+                        found_secrets.append((str(py_file), line_num))
 
         except Exception as e:
             logger.warning(f"Could not read {py_file}: {e}")
 
     if found_secrets:
         logger.error("Potential hardcoded secrets found:")
-        for secret in found_secrets:
-            # Security: Don't log the actual secret content, only the location
-            location = secret.split(':')[0] if ':' in secret else 'unknown location'
-            logger.error(f"  Secret detected at: {location}")
+        for file_path, line_number in found_secrets:
+            # Security: Log only file and line number, never the actual secret content
+            logger.error(f"  Secret detected at: {file_path}:{line_number}")
         return False
     else:
         logger.info("No hardcoded secrets detected")

pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=78.1.1", "wheel"]
+requires = ["setuptools>=80.9.0", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [project]