[ironcommit]

Summary

Reduces CVE surface in container images by removing unused Perl packages, upgrading cryptography to 50.x, and trimming unused Go dependencies in the jobs launcher.

Changes

Perl removal

• Dockerfile.auditor-tasks: Inline purge of perl-base, perl, perl-modules-*, and libperl* with build-time assertions that perl is no longer on PATH and no CVE-tracked Perl packages remain installed.
• docker/scripts/cve-cleanup.sh: Added reusable Perl CVE cleanup block that removes Perl packages, verifies removal, and fails the build if any remain. Intended for images that source this script during build.

cryptography 48 → 50

• Bumped cryptography constraint from >=48.0.1,<49 to >=50.0.0,<51 across:
  • pyproject.toml (constraint-dependencies + override-dependencies)
  • Dockerfile.auditor-tasks
  • Dockerfile.safe-synthesizer-tasks
  • Dockerfile.nmp-automodel-base
  • plugins/nemo-safe-synthesizer/constraints.txt
• Addresses GHSA-g6cj-pr64-35w5.
• uv.lock updated accordingly.

Jobs launcher dependency cleanup

• Bumped Go toolchain from 1.25.8 to 1.25.12.
• Removed go.opentelemetry.io/contrib/exporters/autoexport and all transitive Prometheus/gRPC exporter dependencies that were no longer needed.
• Upgraded google.golang.org/grpc from 1.81.1 to 1.83.0 and golang.org/x/text from 0.38.0 to 0.39.0.
• go.sum updated accordingly.

[coderabbitai]

📝 Walkthrough

Walkthrough

The project and container definitions now require cryptography 50.x. Auditor image cleanup removes installed Perl packages and related files, then verifies their absence. The jobs-launcher module updates its Go version and dependencies.

Changes

CVE Remediation

Layer / File(s)	Summary
Update cryptography constraints pyproject.toml, plugins/nemo-safe-synthesizer/constraints.txt, docker/...	Dependency constraints now require cryptography>=50.0.0,<51. The security annotation references GHSA-g6cj-pr64-35w5.
Remove and verify Perl packages docker/Dockerfile.auditor-tasks, docker/scripts/cve-cleanup.sh	The cleanup detects installed Perl packages, purges them with dependencies, removes Perl files and APT metadata, and fails if Perl or tracked packages remain.

Jobs Launcher Dependency Refresh

Layer / File(s)	Summary
Refresh jobs-launcher module dependencies services/core/jobs/jobs-launcher/go.mod	The module uses Go 1.25.12, removes obsolete dependencies, and updates golang.org/x/text and google.golang.org/grpc.

Possibly related PRs

• NVIDIA-NeMo/nemo-platform#617: Updates the same cryptography constraints in Dockerfiles and plugin constraints.
• NVIDIA-NeMo/nemo-platform#864: Modifies the same jobs-launcher OpenTelemetry and gRPC dependencies.
• NVIDIA-NeMo/nemo-platform#599: Modifies the Safe Synthesizer cryptography constraint files.

Suggested reviewers: crookedstorm

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the two primary changes: removing unused Perl packages and upgrading cryptography to 50.x.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch remove-perl/rsadler

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docker/Dockerfile.auditor-tasks`:
- Around line 97-106: Update the perl_packages pattern in the purge command and
the final dpkg-query verification to include all installed Perl module packages,
including names matching lib*-perl such as libxml-parser-perl. Preserve the
existing purge, file cleanup, and final absence checks while ensuring both
package discovery and verification cover the same complete set of Perl-related
packages.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c35f5535-070b-499b-9c5b-bce75fed606c

📥 Commits

Reviewing files that changed from the base of the PR and between 603b97b and 89d8986.

📒 Files selected for processing (1)

• docker/Dockerfile.auditor-tasks

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	30743/39237	78.3%	62.7%
Integration Tests	18059/37189	48.6%	21.0%

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

🧹 Nitpick comments (1)

docker/scripts/cve-cleanup.sh (1)

40-40: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Use argument-safe expansion for the purge.

perl_packages is a newline-delimited list. Under Bash, the unquoted expansion at Line 40 is subject to word splitting and filename expansion. (gnu.org) Use a shell array or controlled xargs -r, then pass each package as a separate argument. Do not quote the current scalar directly because that would pass all package names as one argument.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/scripts/cve-cleanup.sh` at line 40, Update the purge command in the
cve-cleanup script to pass each entry from perl_packages as a separate argument
using a shell array or controlled xargs -r; avoid both unquoted scalar expansion
and quoting the entire newline-delimited value as one package argument.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@docker/scripts/cve-cleanup.sh`:
- Line 40: Update the purge command in the cve-cleanup script to pass each entry
from perl_packages as a separate argument using a shell array or controlled
xargs -r; avoid both unquoted scalar expansion and quoting the entire
newline-delimited value as one package argument.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3460bd5c-c901-4128-b0ac-ae7e60b44968

📥 Commits

Reviewing files that changed from the base of the PR and between 9fa8b8a and eb6c093.

⛔ Files ignored due to path filters (2)

• services/core/jobs/jobs-launcher/go.sum is excluded by !**/*.sum
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• docker/Dockerfile.auditor-tasks
• docker/Dockerfile.safe-synthesizer-tasks
• docker/automodel/Dockerfile.nmp-automodel-base
• docker/scripts/cve-cleanup.sh
• plugins/nemo-safe-synthesizer/constraints.txt
• pyproject.toml
• services/core/jobs/jobs-launcher/go.mod

🚧 Files skipped from review as they are similar to previous changes (5)

• docker/automodel/Dockerfile.nmp-automodel-base
• docker/Dockerfile.safe-synthesizer-tasks
• pyproject.toml
• docker/Dockerfile.auditor-tasks
• plugins/nemo-safe-synthesizer/constraints.txt

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.