cp "ci: Address setuptools CVE (#1438)"

[thomasdhc]

• Address CVE fixes

• Remove cache of aiohttp from ray

• Update uv lock

• Update cache path

---

Description

Usage

# Add snippet demonstrating usage

Checklist

• I am familiar with the Contributing Guide.
• New or Existing tests cover these changes.
• The documentation is up to date with these changes.

[greptile-apps]

Greptile Overview

Greptile Summary

This PR addresses multiple CVE security vulnerabilities by upgrading package versions and adding constraints:

• setuptools: upgraded from 80.9.0 to 80.10.2 to address CVE GHSA-58pv-8j8x-9vj2
• wheel: upgraded from 0.45.1 to 0.46.3 to address CVE GHSA-8rrh-rw8j-w5fx
• pyasn1: added constraint >=0.6.2 to address CVE GHSA-63vm-454h-vhhq

Additional changes:

• Added Docker build step to remove cached aiohttp files from ray's thirdparty_files directory to prevent vulnerable cached versions from being used
• Broadened setuptools dependency markers in uv.lock to include more Python versions and platforms (removed Python 3.12+ restriction)
• Reorganized constraint-dependencies alphabetically in pyproject.toml

All changes are security-focused and appropriate for a release branch backport.

Confidence Score: 4/5

• This PR is safe to merge with minimal risk, addressing critical CVE vulnerabilities through package version upgrades
• Score reflects security-critical nature of changes with proper constraint updates, though the Docker build step could be more robust with error handling
• docker/Dockerfile should be monitored to ensure the find command doesn't cause build failures

Important Files Changed

Filename	Overview
docker/Dockerfile	Added cleanup command to remove cached aiohttp files from ray's thirdparty_files directory to address CVE-related cached vulnerabilities
pyproject.toml	Added constraints for pyasn1, wheel, and setuptools to address CVEs GHSA-63vm-454h-vhhq, GHSA-8rrh-rw8j-w5fx, and GHSA-58pv-8j8x-9vj2 respectively
uv.lock	Updated setuptools (80.9.0→80.10.2), wheel (0.45.1→0.46.3), added constraints for pyasn1, wheel, and setuptools, and broadened setuptools markers for torch/vllm dependencies

Sequence Diagram

sequenceDiagram
    participant Dev as Developer
    participant UV as UV Package Manager
    participant PyPI as PyPI Registry
    participant Docker as Docker Build
    participant Cache as UV Cache

    Dev->>UV: Update pyproject.toml with CVE constraints
    Note over UV: setuptools>=80.10.1<br/>wheel>=0.46.2<br/>pyasn1>=0.6.2
    
    Dev->>UV: Run uv lock
    UV->>PyPI: Resolve dependencies with constraints
    PyPI-->>UV: Return setuptools 80.10.2
    PyPI-->>UV: Return wheel 0.46.3
    PyPI-->>UV: Return pyasn1 0.6.2+
    UV->>UV: Update uv.lock with resolved versions
    UV->>UV: Broaden setuptools markers for torch/vllm
    
    Dev->>Docker: Build Docker image
    Docker->>UV: uv sync --locked --extra all
    UV->>Cache: Install packages to /opt/uv_cache
    Docker->>UV: uv cache prune
    Docker->>UV: uv cache clean distance
    Docker->>Cache: find and remove cached aiohttp from ray
    Note over Cache: Removes vulnerable cached<br/>aiohttp versions
    Docker-->>Dev: Build complete with CVE fixes

Loading

[greptile-apps]

_{3 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

The find command with -exec rm -rf {} + may fail silently if the path doesn't exist, breaking the Docker build. Consider adding || true to prevent build failures.

Suggested change

	find /opt/uv_cache/ -type d -path "*ray/_private/runtime_env/agent/thirdparty_files/aiohttp*" -exec rm -rf {} +
	find /opt/uv_cache/ -type d -path "*ray/_private/runtime_env/agent/thirdparty_files/aiohttp*" -exec rm -rf {} + || true