Fix Trivy findings in embedded Python packages and containerd

go.mod

@@ -204,7 +204,7 @@ require (
 	github.com/cloudflare/cbpfc v0.0.0-20240920015331-ff978e94500b
 	github.com/cloudfoundry-community/go-cfclient/v2 v2.0.1-0.20230503155151-3d15366c5820
 	github.com/containerd/cgroups/v3 v3.1.2
-	github.com/containerd/containerd v1.7.35
+	github.com/containerd/containerd v1.7.36
 	github.com/containerd/containerd/api v1.9.0
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/typeurl/v2 v2.2.3

scripts/test_embedded_python_security.py

@@ -1,4 +1,4 @@
-"""Check security backports using the packaged Python interpreter."""
+"""Check security fixes using the packaged Python interpreter and dependencies."""
 
 import hashlib
 import io
@@ -10,10 +10,23 @@
 import unittest
 from pathlib import Path
 
+import jwt
 from build._compat.tarfile import safe_extractall
 
 
 class EmbeddedPythonSecurityTests(unittest.TestCase):
+    def test_jwt_options_reuse_preserves_claim_verification(self):
+        # CVE-2026-103001: an unsigned inspection must not mutate reusable
+        # options and disable expiry checking on a later verified decode.
+        secret = 'embedded-python-security-test-key'
+        token = jwt.encode({'exp': 1}, secret, algorithm='HS256')
+        options = {'verify_signature': False}
+        self.assertEqual(jwt.decode(token, options=options), {'exp': 1})
+        self.assertEqual(options, {'verify_signature': False})
+        options['verify_signature'] = True
+        with self.assertRaises(jwt.ExpiredSignatureError):
+            jwt.decode(token, secret, algorithms=['HS256'], options=options)
+
     def test_idna_uses_unicode_3_2_case_folding(self):
         cases = (
             ("\N{CHEROKEE LETTER A}\N{CHEROKEE LETTER A}", b"xn--58da"),

stackstate-deps.json

@@ -1,5 +1,5 @@
 {
-  "STACKSTATE_INTEGRATIONS_VERSION": "7.78.2-6",
+  "STACKSTATE_INTEGRATIONS_VERSION": "f50c336c6b23beb3f2e651dca558e1dba6a5781a",
   "PROCESS_AGENT_BRANCH": "master",
   "PROCESS_AGENT_VERSION": "6737762f",
   "OMNIBUS_SOFTWARE_VERSION": "7.78.2",