fix: trivy unknown severitis for test/kaito-base image

[rambohe-ch]

Reason for Change:

1. I've met the trivy error in this pull request: https://github.com/kaito-project/kaito/actions/runs/21424380339/job/61690448685, and there are 36 unknown severities for test/kaito-base:v0.0.1 image.

in this pull request, we update Debian package handling in [Dockerfile] to run apt-get install related libs, so security-fixed packages (like OpenSSL) get pulled in during image build.

2. install opencv related libs for ministral model depends on them.

Requirements

• added unit tests and e2e tests (if applicable).

Issue Fixed:

Notes for Reviewers:

[kaito-pr-agent]

Title

Fix trivy unknown severities by upgrading Debian packages in Dockerfile

---

Description

• Fixed trivy unknown severities by upgrading Debian packages

• Improved Dockerfile security with apt-get upgrade

• Added autoremove step to clean unused packages

• Enhanced package installation process

---

Changes walkthrough 📝

	Relevant files
Bug fix	Dockerfile Update Debian package handling to include upgrades and autoremove docker/presets/models/tfs/Dockerfile Added apt-get upgrade -y to apply security updates Added apt-get autoremove -y to remove unused packages Improved apt-get install command structure with explicit flags Enhanced package installation process for security +4/-1

---

Need help?

Type /help how to ... in the comments thread for any questions about PR-Agent usage.

Check out the documentation for more information.

[kaito-pr-agent]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

[kaito-pr-agent]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Security	Remove apt-get upgrade for security Avoid using apt-get upgrade in Dockerfiles as it can cause unpredictable builds and security issues. Instead, pin package versions explicitly. The upgrade command may install incompatible versions and bloat the image. Remove this line to maintain deterministic builds. docker/presets/models/tfs/Dockerfile [15-19] RUN apt-get update -y && \ - apt-get upgrade -y && \ apt-get install --no-install-recommends -y curl gcc libc-dev perl && \ apt-get autoremove -y && \ apt-get clean && rm -rf /var/lib/apt/lists/* Suggestion importance[1-10]: 9 __ Why: Removing apt-get upgrade addresses security risks and ensures deterministic builds by preventing unexpected package upgrades. This aligns with Docker best practices for image stability.	High

[zhuangqh]

please bump the base image tag in kaito/presets/workspace/models/support_models.yaml

[rambohe-ch]

please bump the base image tag in kaito/presets/workspace/models/support_models.yaml

fixed, PTAL

[zhuangqh]

Upgrade Compatibility Test is broken because the base image tag was bumped but the upgrade test try to use it.
Skip this test as this test should be recovered once official base image is released.