diff --git a/docker/Dockerfile b/docker/Dockerfile index 5675ad8484..885accb238 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -79,7 +79,8 @@ RUN cd /opt/Curator && \ uv sync --link-mode copy --locked --extra all --all-groups && \ uv add /opt/InternVideo/InternVideo2/multi_modality && \ uv cache prune && \ - uv cache clean distance + uv cache clean distance && \ + find /opt/uv_cache/ -type d -path "*ray/_private/runtime_env/agent/thirdparty_files/aiohttp*" -exec rm -rf {} + COPY <=3.13.3", # Addresses CVE GHSA-6mq8-rvhq-8wgg "protobuf>=4.25.8", # Address CVE GHSA-8qvm-5x2c-j2w7 - "xgrammar>=0.1.21", # Address CVE GHSA-5cmr-4px5-23pc - "starlette>=0.49.1", # Address CVE GHSA-7f5h-v6xp-fcq8 + "pyasn1>=0.6.2", # Address CVE GHSA-63vm-454h-vhhq "ray[default,data]>=2.52", # Address CVE GHSA-q279-jhrf-cc6v + "starlette>=0.49.1", # Address CVE GHSA-7f5h-v6xp-fcq8 "urllib3>=2.6.3", #Address CVE GHSA-38jv-5279-wg99 + "wheel>=0.46.2", #Address CVE GHSA-8rrh-rw8j-w5fx + "xgrammar>=0.1.21", # Address CVE GHSA-5cmr-4px5-23pc ] override-dependencies = [ "apex; sys_platform == 'never'", "distance; sys_platform == 'never'", "kaldiio; sys_platform == 'never'", "levenshtein; sys_platform == 'never'", - "transformers>=4.55.2", "protobuf>=5.29.5", # Override nemo-toolkits constraint of ~=5.29.5 + "setuptools>=80.10.1", # Override setuptools range in other dependencies to address CVE GHSA-58pv-8j8x-9vj2 + "transformers>=4.55.2", ] diff --git a/uv.lock b/uv.lock index cdb744de45..fb6c133df7 100644 --- a/uv.lock +++ b/uv.lock @@ -35,9 +35,11 @@ resolution-markers = [ constraints = [ { name = "aiohttp", specifier = ">=3.13.3" }, { name = "protobuf", specifier = ">=4.25.8" }, + { name = "pyasn1", specifier = ">=0.6.2" }, { name = "ray", extras = ["default", "data"], specifier = ">=2.52" }, { name = "starlette", specifier = ">=0.49.1" }, { name = "urllib3", specifier = ">=2.6.3" }, + { name = "wheel", specifier = ">=0.46.2" }, { name = "xgrammar", specifier = ">=0.1.21" }, ] overrides = [ @@ -46,6 +48,7 @@ overrides = [ { name = "kaldiio", marker = "sys_platform == 'never'" }, { name = "levenshtein", marker = "sys_platform == 'never'" }, { name = "protobuf", specifier = ">=5.29.5" }, + { name = "setuptools", specifier = ">=80.10.1" }, { name = "transformers", specifier = ">=4.55.2" }, ] @@ -7303,11 +7306,11 @@ wheels = [ [[package]] name = "setuptools" -version = "80.9.0" +version = "80.10.2" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/18/5d/3bf57dcd21979b887f014ea83c24ae194cfcd12b9e0fda66b957c69d1fca/setuptools-80.9.0.tar.gz", hash = "sha256:f36b47402ecde768dbfafc46e8e4207b4360c654f1f3bb84475f0a28628fb19c", size = 1319958, upload-time = "2025-05-27T00:56:51.443Z" } +sdist = { url = "https://files.pythonhosted.org/packages/76/95/faf61eb8363f26aa7e1d762267a8d602a1b26d4f3a1e758e92cb3cb8b054/setuptools-80.10.2.tar.gz", hash = "sha256:8b0e9d10c784bf7d262c4e5ec5d4ec94127ce206e8738f29a437945fbc219b70", size = 1200343, upload-time = "2026-01-25T22:38:17.252Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/a3/dc/17031897dae0efacfea57dfd3a82fdd2a2aeb58e0ff71b77b87e44edc772/setuptools-80.9.0-py3-none-any.whl", hash = "sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922", size = 1201486, upload-time = "2025-05-27T00:56:49.664Z" }, + { url = "https://files.pythonhosted.org/packages/94/b8/f1f62a5e3c0ad2ff1d189590bfa4c46b4f3b6e49cef6f26c6ee4e575394d/setuptools-80.10.2-py3-none-any.whl", hash = "sha256:95b30ddfb717250edb492926c92b5221f7ef3fbcc2b07579bcd4a27da21d0173", size = 1064234, upload-time = "2026-01-25T22:38:15.216Z" }, ] [[package]] @@ -7789,7 +7792,7 @@ dependencies = [ { name = "jinja2", marker = "platform_machine != 'x86_64' or sys_platform == 'darwin'" }, { name = "networkx", version = "3.4.2", source = { registry = "https://pypi.org/simple" }, marker = "(python_full_version < '3.11' and platform_machine != 'x86_64') or (python_full_version < '3.11' and sys_platform == 'darwin')" }, { name = "networkx", version = "3.6.1", source = { registry = "https://pypi.org/simple" }, marker = "(python_full_version >= '3.11' and platform_machine != 'x86_64') or (python_full_version >= '3.11' and sys_platform == 'darwin')" }, - { name = "setuptools", marker = "(python_full_version >= '3.12' and platform_machine != 'x86_64') or (python_full_version >= '3.12' and sys_platform == 'darwin')" }, + { name = "setuptools", marker = "platform_machine != 'x86_64' or sys_platform == 'darwin'" }, { name = "sympy", marker = "platform_machine != 'x86_64' or sys_platform == 'darwin'" }, { name = "typing-extensions", marker = "platform_machine != 'x86_64' or sys_platform == 'darwin'" }, ] @@ -7841,18 +7844,18 @@ dependencies = [ { name = "nvidia-nvjitlink-cu12", marker = "platform_machine == 'x86_64' and sys_platform == 'linux'" }, { name = "nvidia-nvshmem-cu12", marker = "platform_machine == 'x86_64' and sys_platform == 'linux'" }, { name = "nvidia-nvtx-cu12", marker = "platform_machine == 'x86_64' and sys_platform == 'linux'" }, - { name = "setuptools", marker = "python_full_version >= '3.12' and platform_machine == 'x86_64' and sys_platform != 'darwin'" }, + { name = "setuptools", marker = "platform_machine == 'x86_64' and sys_platform != 'darwin'" }, { name = "sympy", marker = "platform_machine == 'x86_64' and sys_platform != 'darwin'" }, { name = "triton", marker = "platform_machine == 'x86_64' and sys_platform == 'linux'" }, { name = "typing-extensions", marker = "platform_machine == 'x86_64' and sys_platform != 'darwin'" }, ] wheels = [ - { url = "https://download.pytorch.org/whl/cu128/torch-2.9.1%2Bcu128-cp310-cp310-manylinux_2_28_x86_64.whl" }, - { url = "https://download.pytorch.org/whl/cu128/torch-2.9.1%2Bcu128-cp310-cp310-win_amd64.whl" }, - { url = "https://download.pytorch.org/whl/cu128/torch-2.9.1%2Bcu128-cp311-cp311-manylinux_2_28_x86_64.whl" }, - { url = "https://download.pytorch.org/whl/cu128/torch-2.9.1%2Bcu128-cp311-cp311-win_amd64.whl" }, - { url = "https://download.pytorch.org/whl/cu128/torch-2.9.1%2Bcu128-cp312-cp312-manylinux_2_28_x86_64.whl" }, - { url = "https://download.pytorch.org/whl/cu128/torch-2.9.1%2Bcu128-cp312-cp312-win_amd64.whl" }, + { url = "https://download.pytorch.org/whl/cu128/torch-2.9.1%2Bcu128-cp310-cp310-manylinux_2_28_x86_64.whl", hash = "sha256:c8d670aa0be6fbecd2b0e7b7d514a104dbdefcc3786ca446cf0c3415043ea40a" }, + { url = "https://download.pytorch.org/whl/cu128/torch-2.9.1%2Bcu128-cp310-cp310-win_amd64.whl", hash = "sha256:64399adaa8ea0896d02cf844cba3c5dd77e769520a1af73572599e0eaa2cf551" }, + { url = "https://download.pytorch.org/whl/cu128/torch-2.9.1%2Bcu128-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:2a1da940f0757621d098c9755f7504d791a72a40920ec85a4fd98b20253fca4e" }, + { url = "https://download.pytorch.org/whl/cu128/torch-2.9.1%2Bcu128-cp311-cp311-win_amd64.whl", hash = "sha256:633005a3700e81b5be0df2a7d3c1d48aced23ed927653797a3bd2b144a3aeeb6" }, + { url = "https://download.pytorch.org/whl/cu128/torch-2.9.1%2Bcu128-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:7cb4018f4ce68b61fd3ef87dc1c4ca520731c7b5b200e360ad47b612d7844063" }, + { url = "https://download.pytorch.org/whl/cu128/torch-2.9.1%2Bcu128-cp312-cp312-win_amd64.whl", hash = "sha256:3a01f0b64c10a82d444d9fd06b3e8c567b1158b76b2764b8f51bfd8f535064b0" }, ] [[package]] @@ -8335,7 +8338,7 @@ dependencies = [ { name = "requests", marker = "platform_machine == 'x86_64' and sys_platform != 'darwin'" }, { name = "sentencepiece", marker = "platform_machine == 'x86_64' and sys_platform != 'darwin'" }, { name = "setproctitle", marker = "platform_machine == 'x86_64' and sys_platform != 'darwin'" }, - { name = "setuptools", marker = "python_full_version >= '3.12' and platform_machine == 'x86_64' and sys_platform != 'darwin'" }, + { name = "setuptools", marker = "platform_machine == 'x86_64' and sys_platform != 'darwin'" }, { name = "six", marker = "python_full_version >= '3.12' and platform_machine == 'x86_64' and sys_platform != 'darwin'" }, { name = "tiktoken", marker = "platform_machine == 'x86_64' and sys_platform != 'darwin'" }, { name = "tokenizers", marker = "platform_machine == 'x86_64' and sys_platform != 'darwin'" }, @@ -8515,11 +8518,14 @@ sdist = { url = "https://files.pythonhosted.org/packages/47/6a/62e288da7bcda82b9 [[package]] name = "wheel" -version = "0.45.1" +version = "0.46.3" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/8a/98/2d9906746cdc6a6ef809ae6338005b3f21bb568bea3165cfc6a243fdc25c/wheel-0.45.1.tar.gz", hash = "sha256:661e1abd9198507b1409a20c02106d9670b2576e916d58f520316666abca6729", size = 107545, upload-time = "2024-11-23T00:18:23.513Z" } +dependencies = [ + { name = "packaging" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/89/24/a2eb353a6edac9a0303977c4cb048134959dd2a51b48a269dfc9dde00c8a/wheel-0.46.3.tar.gz", hash = "sha256:e3e79874b07d776c40bd6033f8ddf76a7dad46a7b8aa1b2787a83083519a1803", size = 60605, upload-time = "2026-01-22T12:39:49.136Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/0b/2c/87f3254fd8ffd29e4c02732eee68a83a1d3c346ae39bc6822dcbcb697f2b/wheel-0.45.1-py3-none-any.whl", hash = "sha256:708e7481cc80179af0e556bbf0cc00b8444c7321e2700b8d8580231d13017248", size = 72494, upload-time = "2024-11-23T00:18:21.207Z" }, + { url = "https://files.pythonhosted.org/packages/87/22/b76d483683216dde3d67cba61fb2444be8d5be289bf628c13fc0fd90e5f9/wheel-0.46.3-py3-none-any.whl", hash = "sha256:4b399d56c9d9338230118d705d9737a2a468ccca63d5e813e2a4fc7815d8bc4d", size = 30557, upload-time = "2026-01-22T12:39:48.099Z" }, ] [[package]]