security(deps): bump cloudpathlib from 0.24.0 to 0.25.0

Bumps [cloudpathlib](https://github.com/drivendataorg/cloudpathlib) from 0.24.0 to 0.25.0.
- [Release notes](https://github.com/drivendataorg/cloudpathlib/releases)
- [Changelog](https://github.com/drivendataorg/cloudpathlib/blob/master/HISTORY.md)
- [Commits](https://github.com/drivendataorg/cloudpathlib/compare/v0.24.0...v0.25.0)

---
updated-dependencies:
- dependency-name: cloudpathlib
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.dockerignore

@@ -6,7 +6,6 @@
 !README.md
 !LICENSE
 !MANIFEST.in
-!requirements-ci.txt
 !semantica/
 !semantica/**
 !integrations/

.github/workflows/container-scan.yml

@@ -12,7 +12,6 @@ on:
       - 'README.md'
       - 'LICENSE'
       - 'MANIFEST.in'
-      - 'requirements-ci.txt'
       - 'semantica/**'
       - 'integrations/**'
       - 'explorer/**'

Dockerfile

@@ -9,17 +9,6 @@ RUN npm ci
 COPY explorer/ ./
 RUN mkdir -p /app/semantica && npm run build
 
-# CVE-2026-14456 (OpenSSL QUIC-server DoS, flagged against this base image's
-# openssl/libssl3t64/openssl-provider-legacy): the Debian fix
-# (3.5.7-1~deb13u2) is only in trixie-proposed-updates as of this writing,
-# not yet promoted to trixie-security, so there's no package to pin here
-# today. Deliberately NOT running `apt-get upgrade` to chase it - that
-# breaks build reproducibility (terrascan AC_DOCKER_0052) and still
-# wouldn't reach a proposed-updates-only package. Once Debian ships the fix
-# and rebuilds this tag, the docker Dependabot ecosystem in
-# .github/dependabot.yml opens a PR bumping the digest pin above. Also: this
-# image only serves plain HTTP via uvicorn and never opens a QUIC listener,
-# so the bug isn't reachable here regardless.
 FROM python:3.13-slim@sha256:7ce4b6dfe35e55397b7cda544f8a13f191b7ae28dc5aad71fe664dbc9bc2623f AS runtime
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
@@ -33,27 +22,12 @@ WORKDIR /app
 RUN groupadd --system semantica \
     && useradd --system --gid semantica --home-dir /app --shell /usr/sbin/nologin semantica
 
-COPY pyproject.toml README.md LICENSE MANIFEST.in requirements-ci.txt ./
+COPY pyproject.toml README.md LICENSE MANIFEST.in ./
 COPY semantica/ ./semantica/
 COPY integrations/ ./integrations/
 COPY --from=frontend-builder /app/semantica/static ./semantica/static
 
-# The base image ships an outdated setuptools (CVE-2025-47273); upgrade it
-# explicitly since nothing in our own dependency tree otherwise pulls a
-# newer copy. Pinned to the exact version requirements-ci.txt/pyproject.toml
-# already build against, rather than a floor, per terrascan AC_DOCKER_0010.
-# requirements-ci.txt itself carries the audited, CVE-checked pins for every
-# transitive dependency (see security-scan.yml / security.yml) - feed them
-# in as an unhashed constraints file (pip's hash-checking mode rejects the
-# unhashable local source directory this installs) so the image lands on
-# the same patched versions CI verified, e.g. msgpack>=1.2.1, rather than
-# letting pip freely re-resolve and pick up an unpatched transitive version.
-# (Extracted with Python's re module rather than sed/grep so there's no
-# line-continuation-backslash stripping to get subtly wrong.)
-RUN pip install --no-cache-dir "setuptools==84.0.0" \
-    && python -c "import re, pathlib; pins = re.findall(r'^([A-Za-z0-9._-]+==\S+)', pathlib.Path('requirements-ci.txt').read_text(), re.M); pathlib.Path('/tmp/constraints.txt').write_text('\n'.join(pins))" \
-    && pip install --no-cache-dir -c /tmp/constraints.txt ".[explorer]" \
-    && rm -f /tmp/constraints.txt requirements-ci.txt \
+RUN pip install --no-cache-dir ".[explorer]" \
     && chown -R semantica:semantica /app
 
 USER semantica

requirements-ci.txt

@@ -782,9 +782,9 @@ click-repl==0.3.0 \
     --hash=sha256:17849c23dba3d667247dc4defe1757fff98694e90fe37474f3feebb69ced26a9 \
     --hash=sha256:fb7e06deb8da8de86180a33a9da97ac316751c094c6899382da7feeeeb51b812
     # via celery
-cloudpathlib==0.24.0 \
-    --hash=sha256:b1c51e2d2ec7dc4fed6538991f4aea849d6cf11a7e6b9069f86e461aa1f9b5b4 \
-    --hash=sha256:c521a984e77b47e656fe78e20a7e3e260e0ab45fc69e33ac01094227c979e34a
+cloudpathlib==0.25.0 \
+    --hash=sha256:63612e17778c5e3a51b472def8d785d0aaaf347486d6b6786dc7be627556d4c6 \
+    --hash=sha256:8faef3ed3a0dd71d134e8617b4fdc5ce56a12a6b485c080cfe80106e5f1d1f5d
     # via weasel
 colorlog==6.12.0 \
     --hash=sha256:2a7924c1dadf18b22a0eb8b06d1c7b01d5341707ec1641eb6fcc4fde0c3e8e5f \