fix(security): remediate failing image and dependency audits

.github/workflows/trojanchat-hygiene.yml

@@ -112,6 +112,7 @@ jobs:
         run: |
           pip-audit -r requirements.txt --progress-spinner off --format json --output pip-audit.json
       - name: Upload dependency audit
+        if: always()
         uses: actions/upload-artifact@v7
         with:
           name: pip-audit-report

Dockerfile

@@ -18,10 +18,11 @@ ENV PATH=/opt/venv/bin:$PATH \
     PYTHONDONTWRITEBYTECODE=1 \
     PYTHONPATH=/app
 
-# The base image ships build tooling that is unnecessary at runtime. Removing it
-# also prevents scanners from treating setuptools' vendored build dependencies
-# as remotely exploitable application packages.
-RUN python -m pip uninstall --yes setuptools wheel \
+# The runtime executes Uvicorn from /opt/venv and does not install packages.
+# Remove the base image's package-management tooling and bundled installer
+# payloads so they cannot ship vulnerable vendored dependencies.
+RUN python -m pip uninstall --yes pip setuptools wheel \
+    && rm -rf /usr/local/lib/python3.14/ensurepip \
     && useradd --create-home --uid 10001 appuser
 WORKDIR /app
 

requirements.txt

@@ -1,7 +1,6 @@
 openai>=1.68.0
 groq>=1.1.2
 streamlit>=1.44.0
-mlflow>=2.22.0
 pydantic>=2.10.0
 pydantic-settings>=2.8.0
 python-dotenv>=1.1.0
@@ -14,3 +13,8 @@ prometheus-client>=0.21.0
 PyJWT>=2.12.0
 passlib[bcrypt]>=1.7.4
 python-json-logger>=2.0.7
+
+# Security floors for transitive packages identified by the container scan.
+cryptography>=50.0.0
+msgpack>=1.2.1
+setuptools>=78.1.1