ci: Address setuptools CVE

[thomasdhc]

Description

Usage

# Add snippet demonstrating usage

Checklist

• I am familiar with the Contributing Guide.
• New or Existing tests cover these changes.
• The documentation is up to date with these changes.

[greptile-apps]

Greptile Overview

Greptile Summary

This PR addresses multiple CVE vulnerabilities by updating package version constraints in the dependency management configuration.

Key Changes:

• Updated setuptools constraint to >=80.10.1 (now resolves to 80.10.2) to address CVE GHSA-58pv-8j8x-9vj2
• Added wheel>=0.46.2 constraint (resolves to 0.46.3) to address CVE GHSA-8rrh-rw8j-w5fx
• Added pyasn1>=0.6.2 constraint to address CVE GHSA-63vm-454h-vhhq
• Updated uv.lock with the new package versions and added missing hashes for torch wheels
• Added Dockerfile cleanup command to remove cached aiohttp files from ray's thirdparty directory
• Reordered constraint-dependencies alphabetically for better maintainability

The changes properly enforce minimum versions through constraint-dependencies and use override-dependencies for setuptools to ensure the secure version is used even when other dependencies specify different ranges.

Confidence Score: 4/5

• This PR is safe to merge with minor considerations around the Dockerfile cleanup command
• The CVE fixes are properly implemented through dependency constraints, and the lock file updates are consistent. One minor concern: the find command in the Dockerfile could potentially fail if the target directories don't exist, though this is unlikely to cause issues in practice since the command runs after dependency installation
• docker/Dockerfile may need attention if the cleanup command encounters unexpected directory structures

Important Files Changed

Filename	Overview
docker/Dockerfile	Added cleanup command to remove cached aiohttp files from ray's thirdparty_files directory
pyproject.toml	Added CVE constraint for setuptools >=80.10.1, pyasn1 >=0.6.2, and wheel >=0.46.2; reordered constraint entries alphabetically
uv.lock	Updated setuptools from 80.9.0 to 80.10.2, wheel from 0.45.1 to 0.46.3; added hashes for torch wheels and packaging dependency for wheel

Sequence Diagram

sequenceDiagram
    participant Dev as Developer
    participant UV as UV Package Manager
    participant PyPI as PyPI Registry
    participant Docker as Docker Build
    participant Cache as UV Cache
    
    Note over Dev,Cache: CVE Mitigation Process
    
    Dev->>UV: Update pyproject.toml with CVE constraints
    Note right of Dev: setuptools>=80.10.1<br/>wheel>=0.46.2<br/>pyasn1>=0.6.2
    
    Dev->>UV: Run uv lock update
    UV->>PyPI: Resolve dependencies with constraints
    PyPI-->>UV: Return setuptools 80.10.2, wheel 0.46.3
    UV->>UV: Update uv.lock with new versions
    
    Dev->>Docker: Build Docker image
    Docker->>UV: uv sync --locked --extra all
    UV->>Cache: Install packages to /opt/uv_cache
    Note right of UV: Installs setuptools 80.10.2<br/>wheel 0.46.3 (CVE-free)
    
    Docker->>UV: uv cache prune
    Docker->>UV: uv cache clean distance
    Docker->>Cache: Remove stale aiohttp from ray thirdparty
    Note right of Docker: find /opt/uv_cache/ -type d<br/>-path "*ray/.../aiohttp*"<br/>-exec rm -rf {} +
    
    Note over Dev,Cache: CVE GHSA-58pv-8j8x-9vj2 Addressed

Loading

[greptile-apps]

_{3 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

_{3 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}