[ROB-2920] CVE patches enforcer (#494)

CVE-2025-66418
CVE-2025-66471
tested it works

Author: Avi-Robusta

enforcer/Dockerfile

@@ -4,9 +4,10 @@ ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
 ENV PATH="/app/venv/bin:$PATH"
 
-# Patching CVE-2025-6965
+# Patching CVE-2025-6965 (requires sqlite >= 3.50.2)
+# Alpine's current version (3.51.1-r0) already includes the fix
 RUN apk update && apk add --no-cache --upgrade \
-    sqlite-libs=3.49.2-r1 sqlite=3.49.2-r1
+    sqlite-libs sqlite
 
 # Set the working directory
 WORKDIR /app/enforcer

enforcer/requirements.txt

@@ -6,3 +6,4 @@ PyYAML==6.0.1
 cachetools==5.3.3
 prometheus-client==0.20.0
 kubernetes==26.1.0
+urllib3==2.6.2

helm/krr-enforcer/values.yaml

@@ -11,7 +11,7 @@ certJob:
 image:
   repository: us-central1-docker.pkg.dev/genuine-flight-317411/devel
   name: krr-enforcer
-  tag: 0.3.5
+  tag: 0.3.6
 imagePullPolicy: IfNotPresent
 resources:
   requests: