fix(deps): bump keras override to >=3.14.0 for CVE-2026-1462

CVE-2026-1462: Keras safe_mode bypass allows arbitrary code execution
via TFSMLayer deserialization of malicious SavedModels (CVSS 8.8).

Changes:
- Add keras>=3.14.0 to dependencies/cve-constraints.txt
- Update keras override-dependencies from ~=3.13.2 to >=3.14.0 in all
  tensorflow pyproject.toml files
- Regenerate affected pylock.toml files (keras 3.13.2 -> 3.14.0)

Affected images:
- jupyter/tensorflow/ubi9-python-3.12
- jupyter/rocm/tensorflow/ubi9-python-3.12
- runtimes/tensorflow/ubi9-python-3.12
- runtimes/rocm-tensorflow/ubi9-python-3.12

Reference: https://access.redhat.com/security/cve/CVE-2026-1462
Made-with: Cursor

Author: swattamw2024

dependencies/cve-constraints.txt

@@ -10,3 +10,7 @@
 # RHAIENG-4014: CVE-2026-33236 NLTK path traversal in XML index files
 # Reference: https://access.redhat.com/security/cve/CVE-2026-33236
 nltk>=3.9.4
+
+# RHOAIENG-57858: CVE-2026-1462 Keras safe_mode bypass via TFSMLayer deserialization
+# Reference: https://access.redhat.com/security/cve/CVE-2026-1462
+keras>=3.14.0

jupyter/rocm/tensorflow/ubi9-python-3.12/pylock.toml

@@ -61,7 +61,7 @@ override-dependencies = [
     "cryptography>=46.0.5",
     # tf2onnx has pinned protobuf version, that causes conflict with other packages
     "protobuf==6.31.1",
-    "keras~=3.13.2",
+    "keras>=3.14.0",
     # RHAIENG-2458: CVE-2025-66418 urllib3 decompression vulnerability
     # Upstream: https://github.com/elyra-ai/elyra/issues/3325
     "urllib3>=2.6.0",

jupyter/rocm/tensorflow/ubi9-python-3.12/pyproject.toml

@@ -59,7 +59,7 @@ override-dependencies = [
     "cryptography>=46.0.5",
     # tf2onnx has pinned protobuf version, that causes conflict with other packages
     "protobuf==6.31.1",
-    "keras~=3.13.2",
+    "keras>=3.14.0",
     # RHAIENG-2458: CVE-2025-66418 urllib3 decompression vulnerability
     # Upstream: https://github.com/elyra-ai/elyra/issues/3325
     "urllib3>=2.6.0",

jupyter/tensorflow/ubi9-python-3.12/pylock.toml

@@ -64,7 +64,7 @@ override-dependencies = [
     "cryptography>=46.0.5",
     # tf2onnx has pinned protobuf version, that causes conflict with other packages
     "protobuf==6.31.1",
-    "keras~=3.13.2",
+    "keras>=3.14.0",
     # RHAIENG-3209: CVE-2026-25990  Pillow: Out-of-bounds Write
     # Upstream: https://github.com/vllm-project/llm-compressor/releases/tag/0.7.1.1
     "pillow>=12.1.1",

jupyter/tensorflow/ubi9-python-3.12/pyproject.toml

@@ -63,7 +63,7 @@ override-dependencies = [
     "cryptography>=46.0.5",
     # tf2onnx has pinned protobuf version, that causes conflict with other packages
     "protobuf==6.31.1",
-    "keras~=3.13.2",
+    "keras>=3.14.0",
     # RHAIENG-3209: CVE-2026-25990  Pillow: Out-of-bounds Write
     # Upstream: https://github.com/vllm-project/llm-compressor/releases/tag/0.7.1.1
     "pillow>=12.1.1",