At the end of the last fiscal year, CRL had not yet acquired Cognate, which is why there's no mention of CRL in the 10K.
The wording in the 'risk factors' section is never anything to worry about. I am not worried about them saying they may have to enter into new manufacturing agreements. Flaskworks is likely not included in any of the agreements with Cognate, as they were acquired last year. That in itself would require a new agreement.
Even with an existing agreement in place, they could have been negotiating a new agreement with CRL at the time of the release of the 10K, which would include Flaskworks.