fix(docker): upgrade pip and wheel to patch CVE-2026-24049 (Critical) and CVE-2025-8869

Author: rahuldass19

Dockerfile

@@ -25,6 +25,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends gosu dos2unix &
 # Copy requirements file first to leverage cache
 COPY requirements.txt /app/requirements.txt
 
+# Vulnerability Fix: Upgrade pip and wheel to patch base image CVEs
+# CVE-2026-24049 (Critical): wheel<=0.46.1 -> 0.46.2
+# CVE-2025-8869 (Medium):   pip==24.0 -> latest
+RUN pip install --no-cache-dir --upgrade "pip>=25.0" "wheel>=0.46.2"
+
 # Install dependencies with hash verification
 # Vulnerability Fix: Pin versions with hashes to prevent supply chain attacks
 RUN pip install --no-cache-dir --require-hashes -r /app/requirements.txt