Floor duckdb to 1.4.2 so a build cannot land on CVE-2025-64429

Dockerfile

@@ -3,16 +3,22 @@ FROM python:3.12-slim
 
 # The base tag lags Debian security updates, so upgrade in place rather than
 # ship whatever it last froze. urllib3 is floored because `pip install
-# hotdata` accepts versions with known CVEs. pip is removed once it has done
-# its job: nothing at runtime needs it, and its vendored copies of msgpack and
-# setuptools are scanner findings of their own.
+# hotdata` accepts versions with known CVEs. duckdb is floored for the same
+# reason and against nothing: no dependency here asks for it, so an unpinned
+# `duckdb` is whatever PyPI served the day the layer was built, and 1.4.0-1.4.1
+# were current long enough to be baked in. Those carry CVE-2025-64429, where
+# the encryption path skips the return code of OpenSSL's rand_bytes() and
+# cannot tell a failed generator from a good one; 1.4.2 checks it. The floor,
+# not a pin, so the build keeps taking later releases.
+# pip is removed once it has done its job: nothing at runtime needs it, and its
+# vendored copies of msgpack and setuptools are scanner findings of their own.
 # hotdata-langchain[agents] + langchain-anthropic/openai back the Insights
 # page; the server boots without them (the page says it is off), but the
 # image carries them so an operator only has to set the model env vars.
 RUN apt-get update && \
     apt-get upgrade -y --no-install-recommends && \
     rm -rf /var/lib/apt/lists/* && \
-    pip install --no-cache-dir hotdata duckdb 'urllib3>=2.8.0' \
+    pip install --no-cache-dir hotdata 'duckdb>=1.4.2' 'urllib3>=2.8.0' \
         "hotdata-langchain[agents]" langchain-anthropic langchain-openai && \
     pip uninstall -y pip && \
     useradd --create-home --uid 10001 appuser

docs/operating.md

@@ -16,7 +16,7 @@ isolated rather than filtered out of a shared table.
 ## Running it
 
 ```bash
-uv venv && uv pip install hotdata duckdb
+uv venv && uv pip install hotdata 'duckdb>=1.4.2'
 export HOTDATA_API_KEY=<workspace key>             # or ~/.hotdata/hotdata.json
 export HOTUSAGE_INGEST_TOKEN=<any secret>          # unset = dev mode (accepts all)
 .venv/bin/python server/server.py --host 0.0.0.0 --port 8377