kubeflow-jupyter-web-app: add explicit cachetools dep, fix pip install flags

Add py3.13-cachetools as an explicit runtime dependency. Upstream code
imports cachetools directly (apps/common/utils.py) but it was only
available as a transitive dep of google-auth, which dropped it in
v2.47.0. This caused ModuleNotFoundError at container startup.

Also fix copy-paste bug where werkzeug CVE remediation
(GHSA-hgf8-39gv-g3f2) was installing requests a second time, and add
missing --prefix/--root flags to urllib3, setuptools, and cryptography
pip installs so CVE remediations actually reach the final image.

Fixes: chainguard-dev/customer-issues#3305


Export:  48801f4

Author: developer-guy

cadvisor.yaml

@@ -1,16 +1,13 @@
 package:
   name: cadvisor
   version: "0.56.2"
-  epoch: 7 # go/wolfi-rsc/cadvisor
+  epoch: 6 # CVE-2026-25679 CVE-2026-27139 CVE-2026-27142 CVE-2026-33186
   description: Analyzes resource usage and performance characteristics of running containers.
   copyright:
     - license: Apache-2.0
   resources:
     cpu: "2"
     memory: 7Gi
-  test-resources:
-    cpu: "1"
-    memory: 1Gi
 
 environment:
   contents:

debezium-connector-informix-3.5.yaml

@@ -1,7 +1,7 @@
 package:
   name: debezium-connector-informix-3.5
   version: "3.5.0"
-  epoch: 1 # GHSA-vqf4-7m7x-wgfc
+  epoch: 0
   description: An incubating Debezium CDC connector for IBM Informix database
   copyright:
     - license: Apache-2.0
@@ -34,8 +34,6 @@ pipeline:
 
   - uses: auth/maven
 
-  - uses: maven/pombump
-
   - name: Build
     runs: |
       ./mvnw clean install -B -ntp -f pom.xml -T$(nproc)C \

debezium-connector-informix-3.5/pombump-deps.yaml

@@ -1,13 +1,17 @@
 package:
   name: kubeflow-jupyter-web-app
   version: "1.10.0"
-  epoch: 13 # go/wolfi-rsc/kubeflow-jupyter-web-app
+  epoch: 14 # go/wolfi-rsc/kubeflow-jupyter-web-app
   description: Kubeflow jupyter web app component
   copyright:
     - license: Apache-2.0
   dependencies:
     runtime:
       - bash
+      # cachetools is imported directly by upstream (apps/common/utils.py) but was only
+      # a transitive dep of google-auth, which dropped it in v2.47.0 (PR #1590).
+      # See: https://github.com/chainguard-dev/customer-issues/issues/3305
+      - py${{vars.python-version}}-cachetools
       - py${{vars.python-version}}-gunicorn-bin
   resources:
     cpu: "3"
@@ -54,13 +58,13 @@ pipeline:
       # Upgrade requests to fix GHSA-9hjg-9r4m-mvj7
       $pip install --upgrade "requests>=2.32.4" --prefix=/usr --root="${{targets.destdir}}"
       # Upgrade werkzeug to fix GHSA-hgf8-39gv-g3f2
-      $pip install --upgrade "requests>=2.32.4" --prefix=/usr --root="${{targets.destdir}}"
+      $pip install --upgrade "werkzeug>=3.1.5" --prefix=/usr --root="${{targets.destdir}}"
       # Remediate GHSA-38jv-5279-wg99
-      pip install --upgrade "urllib3>=2.6.3"
+      $pip install --upgrade "urllib3>=2.6.3" --prefix=/usr --root="${{targets.destdir}}"
       # Remediate GHSA-58pv-8j8x-9vj2
-      pip install --upgrade "setuptools>=80.10.1"
+      $pip install --upgrade "setuptools>=80.10.1" --prefix=/usr --root="${{targets.destdir}}"
       # Remediate GHSA-r6ph-v2qm-q3c2
-      pip install --upgrade "cryptography>=46.0.5"
+      $pip install --upgrade "cryptography>=46.0.5" --prefix=/usr --root="${{targets.destdir}}"
       # Remediate GHSA-jr27-m4p2-rc6r
       $pip install --upgrade "pyasn1>=0.6.3" --prefix=/usr --root="${{targets.destdir}}"
       ls -latr /usr/lib/python${{vars.python-version}}/site-packages

kubeflow-jupyter-web-app.yaml

@@ -1,16 +1,10 @@
 package:
   name: oauth2-proxy
   version: "7.15.1"
-  epoch: 1 # go/wolfi-rsc/oauth2-proxy
+  epoch: 0 # GHSA-p77j-4mvh-x3m3
   description: Reverse proxy and static file server that provides authentication using various providers to validate accounts by email, domain or group.
   copyright:
     - license: MIT
-  resources:
-    cpu: "2"
-    memory: 6Gi
-  test-resources:
-    cpu: "1"
-    memory: 3Gi
 
 var-transforms:
   - from: ${{package.version}}