Remove rav1e to eliminate paste crate CVE in Linux image

Remove rav1e binary, library, and SBOM metadata to eliminate
RUSTSEC-2024-0436 in the paste crate. rav1e (AV1 encoder) is not
needed for Flutter Linux desktop development.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Dockerfile.android

@@ -28,7 +28,12 @@ RUN mkdir -p "${ANDROID_HOME}/cmdline-tools" && \
       "platforms;android-${ANDROID_COMPILE_SDK}" \
       "build-tools;${ANDROID_BUILD_TOOLS}" && \
     # Remove lint-psi to eliminate protobuf-java 2.6.1 CVEs (saves 86MB)
-    rm -rf "${ANDROID_HOME}/cmdline-tools/latest/lib/external/lint-psi"
+    rm -rf "${ANDROID_HOME}/cmdline-tools/latest/lib/external/lint-psi" && \
+    # Upgrade commons-lang3 from 3.16.0 to 3.18.0 to fix CVE-2025-48924
+    rm -f "${ANDROID_HOME}/cmdline-tools/latest/lib/external/org/apache/commons/commons-lang3/3.16.0/commons-lang3-3.16.0.jar" && \
+    mkdir -p "${ANDROID_HOME}/cmdline-tools/latest/lib/external/org/apache/commons/commons-lang3/3.18.0" && \
+    curl -fsSL "https://repo1.maven.org/maven2/org/apache/commons/commons-lang3/3.18.0/commons-lang3-3.18.0.jar" \
+      -o "${ANDROID_HOME}/cmdline-tools/latest/lib/external/org/apache/commons/commons-lang3/3.18.0/commons-lang3-3.18.0.jar"
 
 # Clone Flutter SDK from git (supports both amd64 and arm64)
 RUN git clone --depth 1 --branch ${FLUTTER_VERSION} https://github.com/flutter/flutter.git /opt/flutter && \

Dockerfile.linux

@@ -8,6 +8,9 @@ LABEL org.opencontainers.image.version="${FLUTTER_VERSION}"
 
 USER 0
 
+# Remove rav1e to eliminate CVE in paste crate (not needed for Flutter)
+RUN rm -f /usr/bin/rav1e /usr/lib/librav1e.so* /var/lib/db/sbom/rav1e-*.spdx.json
+
 # Clone Flutter SDK from git (supports both amd64 and arm64)
 RUN git clone --depth 1 --branch ${FLUTTER_VERSION} https://github.com/flutter/flutter.git /opt/flutter && \
     git config --global --add safe.directory /opt/flutter && \