cp: ci: Address setuptools CVE (1438) into r1.1.0

[thomasdhc]

beep boop [🤖]: Hi @thomasdhc 👋,

we've cherry picked #1438 into  for you! 🚀

Please review and approve this cherry pick by your convenience!

[thomasdhc]

/ok to test 8d09d0e

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[greptile-apps]

Greptile Overview

Greptile Summary

This PR cherry-picks security fixes from #1438 to address multiple CVE vulnerabilities by updating package constraints and cleaning cached dependencies.

Key changes:

• Added setuptools>=80.10.1 override to address CVE GHSA-58pv-8j8x-9vj2
• Added constraints for wheel>=0.46.2 (CVE GHSA-8rrh-rw8j-w5fx) and pyasn1>=0.6.2 (CVE GHSA-63vm-454h-vhhq)
• Updated uv.lock with setuptools 80.10.2 and wheel 0.46.3
• Added Dockerfile cleanup step to remove cached vulnerable aiohttp files from ray dependencies

The changes are straightforward dependency version bumps to patch known security vulnerabilities. The cherry-pick appears clean with no merge conflicts.

Confidence Score: 5/5

• This PR is safe to merge - it only updates dependency versions to address CVEs
• All changes are security patches updating dependencies to non-vulnerable versions. The changes are minimal, well-documented with CVE references, and follow standard security remediation practices. The Dockerfile cache cleanup ensures no vulnerable cached versions remain.
• No files require special attention

Important Files Changed

Filename	Overview
pyproject.toml	Added setuptools>=80.10.1 override and additional CVE constraints (pyasn1, wheel) to address security vulnerabilities
docker/Dockerfile	Added cache cleanup command to remove vulnerable cached aiohttp files from ray dependencies
uv.lock	Updated setuptools to 80.10.2 and wheel to 0.46.3, added constraints for pyasn1 and wheel, updated torch wheel hashes

Sequence Diagram

sequenceDiagram
    participant Dev as Developer
    participant UV as UV Package Manager
    participant PyPI as PyPI Registry
    participant Docker as Docker Build
    participant Cache as UV Cache

    Dev->>UV: Update pyproject.toml with CVE constraints
    Note over UV: setuptools>=80.10.1<br/>wheel>=0.46.2<br/>pyasn1>=0.6.2
    
    Dev->>UV: Run uv lock
    UV->>PyPI: Resolve dependencies with constraints
    PyPI-->>UV: Return setuptools 80.10.2, wheel 0.46.3
    UV->>UV: Generate uv.lock with updated versions
    
    Dev->>Docker: Build Docker image
    Docker->>UV: uv sync with locked dependencies
    UV->>Cache: Install dependencies to cache
    Cache-->>UV: Dependencies installed
    
    Docker->>Cache: Clean vulnerable aiohttp from ray cache
    Note over Cache: Remove ray/_private/runtime_env/<br/>agent/thirdparty_files/aiohttp*
    
    Docker-->>Dev: Image built with patched dependencies

Loading

[greptile-apps]

_{3 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}