[anaconda]: Security updates for pip, gitpython, anyio, soupsieve.

[Venkumahanti Subhankar (V-Subhankar-infy)]

Problem

The Anaconda image contains Python packages affected by security advisories:

• pip: GHSA-qwm4-qh6w-59xr
• GitPython: GHSA-239g-whfq-7xj9
• anyio: GHSA-82r6-8w77-94w6
• soupsieve: GHSA-gjv8-xp57-g29c

Solution

• Update pip from 26.1.2 to 26.2.0.
• Update GitPython from 3.1.50 to 3.1.60.
• Add exact security patch pins for anyio 4.14.2 and soupsieve 2.9.0.
• Update the security-advisory references in the patch script.
• Extend the smoke test to verify all four patched package versions.
• Bump the Anaconda image patch version from 1.4.3 to 1.4.4.

Deferred Transformers Update

transformers is affected by GHSA-xrqw-3rrv-vx5w, but its update from 4.53.0 to 5.10.0 is intentionally excluded from this PR.

Transformers v5 removes TensorFlow and Flax backends, along with legacy modules, which would break existing workloads using those APIs. It will be addressed in a dedicated PR with a major Anaconda image-version bump to 2.0.0, README tag updates, and focused compatibility validation.

Impact

• No image variants, tags, base image, or configuration behavior changes.
• This PR limits its runtime changes to the four non-major security package updates.
• Intentionally leaving out the updating of readme due to waiting for release to auto-bump readme based on manifest as this is a patch bump and prepare release automation would take care of this. This might seem like a mismatch in readme/manifest but based on [docs] - Clarify stable & development image tags availability and contribution rules. #2030 this is the better way.
• Intentionally keeping the security updates failsafe to ignore the updates(if unavailable) is untouched so that a simple vulnerability fix does not stop the builds.

[Copilot]

Copilot review overview

🟢 Approval recommended

The security patches, smoke-test expectations, and semantic patch-version bump are consistent and complete.

Review effort: Balanced
Findings: None