fix(security): patch sqlparse and grpc image CVEs

[thomasrockhu-codecov]

Summary

• upgrade sqlparse to 0.6.0 across API and worker images to fix CVE-2026-54284, CVE-2026-59893, and CVE-2026-71491
• rebuild berglas with google.golang.org/grpc 1.82.1 to fix GO-2026-6061

Test plan

• uv lock --check
• API and worker image build jobs pass in CI
• API and worker test jobs pass in CI
• scan built image digests and confirm all four vulnerability IDs are absent

Made with Cursor

[thomasrockhu-codecov]

✨ Harness AI Code Review

View in Harness →

✅ Risk: LOW

This PR patches CVEs by bumping sqlparse to >=0.6.0 across the API and worker pyproject.toml sections (with matching uv.lock updates) and pinning google.golang.org/grpc@v1.82.1 in the berglas build stage of docker/Dockerfile. It is a dependency-only change with no application code touched, so there is no new runtime logic to review. The version bumps and lockfile entries are internally consistent and match the stated intent.

No issues found above the confidence threshold.

[codspeed-hq]

Merging this PR will not alter performance

✅ 9 untouched benchmarks

---

_{Comparing th/sqlparse-grpc-cves (bf7af2e) with main (68c86d1)¹}

Footnotes

1. No successful run was found on main (a8ec2db) during the generation of this report, so 68c86d1 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[codecov-notifications]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.63%. Comparing base (a8ec2db) to head (bf7af2e).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2039   +/-   ##
=======================================
  Coverage   91.63%   91.63%           
=======================================
  Files        1336     1336           
  Lines       53230    53230           
  Branches     1647     1647           
=======================================
  Hits        48778    48778           
  Misses       4131     4131           
  Partials      321      321           

Flag	Coverage Δ
apiunit	93.99% <ø> (ø)
sharedintegration	36.76% <ø> (ø)
sharedunit	84.88% <ø> (ø)
workerintegration	58.49% <ø> (ø)
workerunit	90.55% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.