ThreatCull 2.5.1

Updated base images and dependencies. Nothing to do when upgrading.

Changed

• 📦 Dependency updates. The Docker Hardened Images python:3.14 and python:3.14-dev bases move
  to new digests, the image builds with uv 0.13.1, and FastAPI goes to 0.143.0 and pydantic to
  2.14.1.

Security

• 🔐 libexpat1 CVEs in the base image are not reachable. The python:3.14 base still ships
  libexpat1 2.8.3-1~deb13u1+dhi5, which has CVE-2026-66046, CVE-2026-77214, CVE-2026-93990,
  CVE-2026-76956, CVE-2026-76957 and CVE-2026-102633, fixed in 2.9.0-1~deb13u1. Expat parses XML
  and ThreatCull parses none, so the image scan ignores these CVEs until a Docker Hardened Images
  digest ships the fix.