fix: remediate auditor and safe-synth task container CVEs

Signed-off-by: Matt Kornfield <[email protected]>

Author: mckornfield

docker-bake.hcl

@@ -932,9 +932,6 @@ target "auditor-tasks-docker" {
   contexts = {
     root-lib-source-artifacts = "target:root-lib-source-artifacts"
     root-busybox              = "target:root-busybox"
-    nmp-python-base           = "target:nmp-python-base"
-    nmp-python-dev-base       = "target:nmp-python-dev-base"
-    root-distroless-base-3-11 = "target:root-distroless-base-3-11"
   }
   dockerfile = "docker/Dockerfile.auditor-tasks"
   cache-to   = maybe_registry_cache_to("auditor-tasks")

docker/Dockerfile.auditor-tasks

@@ -1,15 +1,32 @@
 # hadolint global ignore=DL3059
-# distroless images don't have a real shell - & and | are not enabled
+# The final image copies BusyBox shell utilities for parity with the task runtime.
 
-ARG NMP_PYTHON_BASE=nmp-python-base
+ARG AUDITOR_PYTHON_IMAGE=python:3.13.14-slim-trixie
 
 ARG CACHE_HOME=/tmp/.cache
 
-FROM nmp-python-dev-base AS py-builder
-
-ARG TARGETARCH
+FROM ${AUDITOR_PYTHON_IMAGE} AS py-builder
 
 ARG CACHE_HOME
+RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends \
+    build-essential \
+    ca-certificates \
+    curl \
+    g++ \
+    gcc \
+    git \
+    libffi-dev \
+    libpq-dev \
+    libssl-dev \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=ghcr.io/astral-sh/uv:0.9.14 /uv /bin/uv
+
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy
+
+WORKDIR /app
 RUN mkdir -p ${CACHE_HOME} && chmod 777 ${CACHE_HOME}
 
 # Create the directory structure to match the relative paths in pyproject.toml
@@ -57,7 +74,8 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     "protobuf>=6.33.5,<7.0.0" \
     "langchain-core>=1.2.22" \
     "orjson>=3.11.6" \
-    "nltk>=3.9.3"
+    "cryptography>=48.0.1,<49" \
+    "nltk>=3.10.0"
 
 # CVE Remediation
 RUN --mount=type=cache,target=/root/.cache/uv \
@@ -68,13 +86,17 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     "pyasn1>=0.6.3" \
     "wheel>=0.46.2" \
     "orjson>=3.11.6" \
-    "nltk>=3.9.3"
+    "cryptography>=48.0.1,<49" \
+    "nltk>=3.10.0"
 
-FROM ${NMP_PYTHON_BASE} AS base
+FROM ${AUDITOR_PYTHON_IMAGE} AS base
 ARG USERNAME=nvs
 ARG USER_UID=1000
 ARG USER_GID=1000
 WORKDIR /app
+RUN apt-get update && apt-get upgrade -y && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
 RUN groupadd --gid ${USER_GID} ${USERNAME} && \
     useradd --uid ${USER_UID} --gid ${USER_GID} --create-home --shell /bin/bash ${USERNAME}
 

docker/Dockerfile.nmp-unsloth-training

@@ -5,8 +5,9 @@
 #
 # Install steps:
 #   1. `uv pip install unsloth --torch-backend=auto` plus explicit
-#      `transformers==4.57.6` and `huggingface-hub==0.36.2` pins (transformers
-#      4.57.x requires hub <1.0; platform glue would otherwise pull hub 1.x).
+#      `transformers==5.3.0` and `huggingface-hub==1.3.0` pins. Unsloth's
+#      resolver allows transformers 5.3.0, and the explicit pins keep later
+#      platform glue installs from re-solving the HF stack.
 #      Unsloth's resolver still pulls unsloth_zoo
 #      and the rest of the HF stack (trl, peft, accelerate, datasets,
 #      bitsandbytes, xformers, etc.). `--overrides preserve_base_torch.txt`
@@ -70,8 +71,8 @@ ARG USERNAME=ubuntu
 ARG USER_UID=1000
 ARG USER_GID=1000
 ARG UNSLOTH_VERSION=2026.6.1
-ARG TRANSFORMERS_VERSION=4.57.6
-ARG HF_HUB_VERSION=0.36.2
+ARG TRANSFORMERS_VERSION=5.3.0
+ARG HF_HUB_VERSION=1.3.0
 ARG BITSANDBYTES_VERSION=0.49.2
 ARG BNB_MAX_JOBS=10
 

docker/Dockerfile.safe-synthesizer-tasks

@@ -11,10 +11,10 @@
 ARG PYTHON_VERSION=3.13
 ARG PYTHON_IMAGE=python:${PYTHON_VERSION}-slim-trixie
 ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.9.30
-ARG SAFE_SYNTHESIZER_RUNTIME_PACKAGE="nemo-safe-synthesizer[engine,cu129]==0.1.2"
+ARG SAFE_SYNTHESIZER_RUNTIME_PACKAGE="nemo-safe-synthesizer[engine,cu129]==0.1.7"
 ARG FLASHINFER_CU129_INDEX_URL="https://flashinfer.ai/whl/cu129"
 ARG PYTORCH_CU129_INDEX_URL="https://download.pytorch.org/whl/cu129"
-ARG VLLM_CU129_WHEEL="vllm @ https://github.com/vllm-project/vllm/releases/download/v0.20.0/vllm-0.20.0%2Bcu129-cp38-abi3-manylinux_2_31_x86_64.whl"
+ARG VLLM_CU129_INDEX_URL="https://wheels.vllm.ai/ee0da84ab9e04ac7610e28580af62c365e898389/cu129"
 
 # =============================================================================
 # uv binary
@@ -29,7 +29,7 @@ ARG PYTHON_IMAGE
 ARG SAFE_SYNTHESIZER_RUNTIME_PACKAGE
 ARG FLASHINFER_CU129_INDEX_URL
 ARG PYTORCH_CU129_INDEX_URL
-ARG VLLM_CU129_WHEEL
+ARG VLLM_CU129_INDEX_URL
 ARG CONTAINER_VARIANT=cu129
 ARG USERNAME=nemo
 ARG USER_UID=1000
@@ -110,11 +110,10 @@ RUN printf '%s\n' \
     printf '%s\n' \
         "${SAFE_SYNTHESIZER_RUNTIME_PACKAGE}" \
         > /tmp/safe-synthesizer-runtime.txt && \
-    printf '%s\n' \
-        "${VLLM_CU129_WHEEL}" \
-        > /tmp/vllm-cu129.txt && \
     printf '%s\n' \
         wandb==0.27.2 \
+        'cryptography>=48.0.1,<49' \
+        'pyarrow>=23.0.1,<24' \
         > /tmp/safe-synthesizer-overrides.txt
 
 RUN --mount=type=cache,target=/root/.cache/uv \
@@ -157,12 +156,12 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     UV_CACHE_DIR=/root/.cache/uv uv pip install --python /opt/venv/bin/python \
         --extra-index-url "${FLASHINFER_CU129_INDEX_URL}" \
         --extra-index-url "${PYTORCH_CU129_INDEX_URL}" \
+        --extra-index-url "${VLLM_CU129_INDEX_URL}" \
         --index-strategy unsafe-best-match \
         --torch-backend cu129 \
         --overrides /tmp/safe-synthesizer-overrides.txt \
         --constraints /tmp/safe-synthesizer-constraints.txt \
-        --requirements /tmp/safe-synthesizer-runtime.txt \
-        --requirements /tmp/vllm-cu129.txt
+        --requirements /tmp/safe-synthesizer-runtime.txt
 
 COPY pyproject.toml uv.lock ./
 COPY packages/ packages/
@@ -179,9 +178,13 @@ RUN mkdir -p docs && \
 # Skip the `nemo-platform` wrapper wheel: it bundles every first-party plugin and
 # service, which drags unrelated source trees into this task image. The runtime
 # imports come from nemo-platform-sdk, nemo-platform-plugin, and nmp-common.
+# The runtime layer above installs CVE-patched cryptography/pyarrow; do not let
+# the workspace lock downgrade them during plugin sync.
 RUN --mount=type=cache,target=/root/.cache/uv \
     UV_CACHE_DIR=/root/.cache/uv uv sync --package nemo-safe-synthesizer-plugin --no-dev --no-editable --inexact \
-        --no-install-package nemo-platform
+        --no-install-package nemo-platform \
+        --no-install-package cryptography \
+        --no-install-package pyarrow
 
 COPY docker/scripts/cve-cleanup.sh /bin/
 RUN bash /bin/cve-cleanup.sh

packages/nemo_platform/pyproject.toml

@@ -351,7 +351,7 @@ nemo-safe-synthesizer-plugin = [
   "gunicorn>=23.0.0",
   "httpx>=0.27.2",
   "nemo-platform-plugin",
-  "nemo-safe-synthesizer==0.1.2",
+  "nemo-safe-synthesizer==0.1.7",
   "pydantic[email]>=2.9.2",
   "pydantic-settings>=2.2.1",
   "python-multipart~=0.0.9",

plugins/nemo-safe-synthesizer/constraints.txt

@@ -1,17 +1,17 @@
-# Vendored from https://github.com/NVIDIA-NeMo/Safe-Synthesizer/blob/v0.1.2/constraints.txt
-# on 2026-06-30. Local additions keep the AWS SDK packages aligned with
-# NeMo Platform's aiobotocore-compatible range.
+# Security floor constraints -- generated from [tool.uv] constraint-dependencies in pyproject.toml
+# Vendored from https://github.com/NVIDIA-NeMo/Safe-Synthesizer/blob/v0.1.7/constraints.txt
+# on 2026-07-10. Local additions keep pyarrow/cryptography on CVE-fixed
+# versions and the AWS SDK packages aligned with NeMo Platform's
+# aiobotocore-compatible range.
 #
 # Pass to pip/uv with:  pip install <pkg> -c constraints.txt
 #                        uv pip install <pkg> -c constraints.txt
-
-# Security floor constraints -- generated from [tool.uv] constraint-dependencies in pyproject.toml
 GitPython>=3.1.50
-PyJWT>=2.12.0
+PyJWT>=2.13.0
 Pygments>=2.20.0
-aiohttp>=3.13.4
+aiohttp>=3.14.0
 cbor2>=5.9.0
-cryptography>=46.0.7
+cryptography>=48.0.1,<49
 grpcio>=1.80.0
 idna>=3.15
 jsonpath-ng>=1.8.0
@@ -21,11 +21,14 @@ mistune>=3.2.1
 nbconvert>=7.17.1
 pandas<3
 pillow>=12.2.0
+pyarrow>=23.0.1,<24
 pymdown-extensions>=10.21.3
 python-dotenv>=1.2.2
 python-multipart>=0.0.27
 requests>=2.33.0
+starlette>=1.0.1
 tornado>=6.5.5
+urllib3>=2.7.0
 
 # Runtime compatibility constraints.
 boto3>=1.40.46,<1.40.62

plugins/nemo-safe-synthesizer/pyproject.toml

@@ -12,7 +12,7 @@ dependencies = [
     "httpx>=0.27.2",
     "nemo-platform",
     "nemo-platform-plugin",
-    "nemo-safe-synthesizer==0.1.2",
+    "nemo-safe-synthesizer==0.1.7",
     "pydantic[email]>=2.9.2",
     "pydantic-settings>=2.2.1",
     "python-multipart~=0.0.9",

plugins/nemo-safe-synthesizer/src/nemo_safe_synthesizer_plugin/config.py

@@ -31,7 +31,7 @@ class SafeSynthesizerConfig(NemoConfig):
         ),
     )
     runtime_venv: str = ".nemo/safe-synthesizer-runtime"
-    runtime_package: str = "nemo-safe-synthesizer[engine,cu129]==0.1.2"
+    runtime_package: str = "nemo-safe-synthesizer[engine,cu129]==0.1.7"
     runtime_python_version: str = "3.11"
     runtime_python: str | None = None
     default_job_resource_memory_request: str = "16G"

plugins/nemo-safe-synthesizer/src/nemo_safe_synthesizer_plugin/runtime.py

@@ -5,7 +5,6 @@
 
 from __future__ import annotations
 
-import platform
 import shutil
 import subprocess
 from pathlib import Path
@@ -23,21 +22,7 @@
 RUNTIME_CONSTRAINTS_FILE = Path("plugins/nemo-safe-synthesizer/constraints.txt")
 FLASHINFER_CU129_INDEX_URL = "https://flashinfer.ai/whl/cu129"
 PYTORCH_CU129_INDEX_URL = "https://download.pytorch.org/whl/cu129"
-VLLM_CU129_VERSION = "0.20.0"
-
-
-def vllm_cu129_wheel() -> str:
-    """Return the direct vLLM CUDA 12.9 wheel URL for the current host."""
-    machine = platform.machine().lower()
-    if machine in {"amd64", "x86_64"}:
-        arch = "x86_64"
-    elif machine in {"aarch64", "arm64"}:
-        arch = "aarch64"
-    else:
-        raise RuntimeError(f"Unsupported architecture for vLLM CUDA 12.9 wheel: {platform.machine()}")
-
-    wheel = f"vllm-{VLLM_CU129_VERSION}%2Bcu129-cp38-abi3-manylinux_2_31_{arch}.whl"
-    return f"vllm @ https://github.com/vllm-project/vllm/releases/download/v{VLLM_CU129_VERSION}/{wheel}"
+VLLM_CU129_INDEX_URL = "https://wheels.vllm.ai/ee0da84ab9e04ac7610e28580af62c365e898389/cu129"
 
 
 def runtime_package_index_options(runtime_package: str) -> list[str]:
@@ -49,14 +34,18 @@ def runtime_package_index_options(runtime_package: str) -> list[str]:
         FLASHINFER_CU129_INDEX_URL,
         "--extra-index-url",
         PYTORCH_CU129_INDEX_URL,
+        "--extra-index-url",
+        VLLM_CU129_INDEX_URL,
     ]
 
 
 def runtime_package_extra_requirements(runtime_package: str) -> list[str]:
     """Return direct requirements needed by the selected runtime package."""
     if "cu129" not in runtime_package:
         return []
-    return [vllm_cu129_wheel()]
+    # Safe Synthesizer 0.1.7 declares its cu129 vLLM dependency directly; the
+    # runtime only needs to add the vLLM wheel index above.
+    return []
 
 
 def repo_root() -> Path:

plugins/nemo-safe-synthesizer/tests/unit/test_runtime.py

@@ -51,8 +51,10 @@ def test_cuda_runtime_package_adds_cu129_sources():
         runtime.FLASHINFER_CU129_INDEX_URL,
         "--extra-index-url",
         runtime.PYTORCH_CU129_INDEX_URL,
+        "--extra-index-url",
+        runtime.VLLM_CU129_INDEX_URL,
     ]
-    assert runtime.runtime_package_extra_requirements(runtime_package) == [runtime.vllm_cu129_wheel()]
+    assert runtime.runtime_package_extra_requirements(runtime_package) == []
 
 
 def test_non_cu129_runtime_package_does_not_add_cu129_sources():
@@ -90,7 +92,7 @@ def fake_run(command, **kwargs):
     assert "--extra-index-url" in calls[2][0]
     assert runtime.FLASHINFER_CU129_INDEX_URL in calls[2][0]
     assert runtime.PYTORCH_CU129_INDEX_URL in calls[2][0]
-    assert runtime.vllm_cu129_wheel() in calls[2][0]
+    assert runtime.VLLM_CU129_INDEX_URL in calls[2][0]
     assert str(tmp_path / "plugins/nemo-safe-synthesizer") not in calls[2][0]
     assert "nemo-safe-synthesizer[engine,cu129]" in calls[2][0]
     assert calls[3][0] == [