fix(build): update Python dependencies without upgrading Checkov

[Marcel Bindseil (bindsi)]

Pull Request

IMPORTANT: Before submitting, please remove all sensitive data, secrets, tokens, or confidential information. Ensure you've redacted any NDA-covered information, IP addresses, resource names, or security-related details that shouldn't be publicly disclosed.

Description

Carry forward the GitPython, HCL2, and NumPy updates from #808 while retaining Checkov 3.2.531. This avoids introducing ecdsa 0.19.2, which caused Dependency Review and Grype to fail on the grouped Checkov upgrade with GHSA-wj6h-64fc-37mp.

Related Issue

Relates to #808. The Checkov upgrade remains deferred and is not included here.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Blueprint modification or addition
• Component modification or addition
• Documentation update
• CI/CD pipeline change
• Other (please describe): dependency updates

Implementation Details

• Update root GitPython from 3.1.61 to 3.1.62 and python-hcl2 from 8.1.3 to 8.1.4.
• Update NumPy from 2.5.2 to 2.5.3 in the root and ROS2 service lockfiles; raise the ROS2 input minimum accordingly.
• Regenerate hash-pinned requirements with Python 3.12 and targeted pip-tools upgrades. Preserve the ROS2 Linux-only notify2 dependency and verify the complete resolved Linux package sets.
• Leave Checkov constraints, its 3.2.531 lock, application source, and security policy unchanged. No ecdsa entry is added.

Testing Performed

• Terraform plan/apply

• Blueprint deployment test

• Unit tests

• Integration tests

• Bug fix includes regression test (see Test Policy)

• Manual validation

• Other: dependency resolution, security scan, and patch validation

• Linux-targeted Python 3.12 resolution matched every pinned package: 96 root packages and 55 ROS2 packages.

• Assertions confirmed Checkov 3.2.531, the intended upgraded versions, the retained notify2 pin, and absence of ecdsa from root requirements.

• Grype 0.116.0 passed on a clean repository snapshot containing these changes, using the unchanged .grype.yaml policy. No unignored High or Critical findings were reported; two existing Medium asteval 1.0.6 advisories remain.

• The committed lockfiles match the validated snapshots. git diff --check origin/main...HEAD passed.

Application unit/integration tests, ROS2 container builds, and hosted CI were not run locally. Local Grype is newer than CI's pinned 0.109.1; hosted checks remain the merge gate.

Validation Steps

1. Confirm the changed package pins and hashes, retained Checkov version, and absence of an added ecdsa dependency.
2. Run Dependency Review and Security Scan with the existing repository policy.
3. Run the applicable Linux application build checks and require a passing PR Validation Gate before merging.

Checklist

• I have updated the documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have run terraform fmt on all Terraform code
• I have run terraform validate on all Terraform code
• I have run az bicep format on all Bicep code
• I have run az bicep build to validate all Bicep code
• I have checked for any sensitive data/tokens that should not be committed
• Lint checks pass (run applicable linters for changed file types)

Security Review

• No credentials, secrets, or tokens are hardcoded or logged
• RBAC and identity changes follow least-privilege principles
• No new network exposure or public endpoints introduced without justification
• Dependency additions or updates have been reviewed for known vulnerabilities
• Container image changes use pinned digests or SHA references

Additional Notes

This change does not remediate the existing asteval advisories, GHSA-89v8-rhwq-hf77 and GHSA-9w56-46f6-3qhx. Their reported fixed version is 1.0.9; compatibility with Checkov needs separate validation. No advisory exceptions or scanner thresholds are changed.

Screenshots (if applicable)